fix: let OpenCode target the relay repository

[PANDAJSR]

Summary

• expose the cross-repository token to OpenCode as GH_TOKEN
• include the private SECTL/secagent-official-relay repository in the allowlist when accessible
• allow the agent to target explicitly named associated SECTL service repositories instead of requiring SecAgent in the name

Root cause

The workflow's repository discovery filtered on names containing SecAgent, so it could never include the private relay repository. In addition, the agent prompt restricted cross-repository work to that naming pattern. The cross-repository token was available to the workflow but was not enough to make the relay an allowed target.

Validation

• SECTL_SECAGENT_GITHUB_TOKEN is configured on SECTL/SecAgent
• the token can access SECTL/secagent-official-relay
• workflow YAML parsed successfully
• git diff --check passed