feat: granularized permissions for research and task-manager subagents to remove edit access

.config/opencode/agent/subagents/build.md

@@ -5,11 +5,10 @@ model: github-copilot/gpt-4.1
 temperature: 0.1
 tools:
   webfetch: false
+  edit: false
 permissions:
   bash:
     "*": "allow"
-  edit:
-    "**/*": "deny"
 ---
 
 # Build Agent (@build)

.config/opencode/agent/subagents/research.md

@@ -7,6 +7,7 @@ tools:
   bash: false
   patch: false
   write: false
+  edit: false
 permissions:
   bash:
     "chmod *": "ask"
@@ -16,12 +17,6 @@ permissions:
     "rm -rf *": "ask"
     "sudo *": "deny"
     "wget *": "ask"
-  edit:
-    "**/*.env*": "deny"
-    "**/*.key": "deny"
-    "**/*.secret": "deny"
-    ".git/**": "deny"
-    "node_modules/**": "deny"
 ---
 
 # Research Subagent (@research)

.config/opencode/agent/subagents/task-manager.md

@@ -5,7 +5,12 @@ model: github-copilot/gpt-4.1
 temperature: 0.1
 tools:
   bash: false
-  edit: false
+permissions:
+  edit:
+    "tasks/**": "allow"
+    "tasks/**/*.md": "allow"
+    "index.md": "allow"
+    "**/*": "deny"
 ---
 
 # Task Manager Subagent (@subagents/task-manager)