fix: reduce permissions and fix npm and opencode versions

Dockerfile

@@ -4,6 +4,7 @@ ARG UBUNTU_VERSION=26.04
 FROM ubuntu:${UBUNTU_VERSION}
 
 ARG NODE_VERSION=24.21.0
+ARG OPENCODE_VERSION=2.0.3
 
 ARG DEV_UID=1000
 ARG DEV_GID=1000
@@ -43,7 +44,6 @@ RUN apt-get update \
         python3-pip \
         python3-venv \
         ripgrep \
-        sudo \
         tar \
         tree \
         unzip \
@@ -67,9 +67,7 @@ RUN groupadd --gid "${DEV_GID}" dev \
         --uid "${DEV_UID}" \
         --gid "${DEV_GID}" \
         --create-home \
-        --shell /bin/bash dev \
-    && echo 'dev ALL=(ALL) NOPASSWD:ALL' > /etc/sudoers.d/dev \
-    && chmod 0440 /etc/sudoers.d/dev
+        --shell /bin/bash dev
 
 # Node.js + OpenCode
 RUN curl -fsSLO \
@@ -81,7 +79,7 @@ RUN curl -fsSLO \
     && rm "node-v${NODE_VERSION}-linux-x64.tar.xz" \
     && echo -n "node version: " && node --version \
     && echo -n "npm version: " && npm --version \
-    && npm install -g @opencode/cli \
+    && npm install -g "@opencode/cli@${OPENCODE_VERSION}" \
     && echo -n "opencode version: " && opencode --version \
     && npm cache clean --force