#383 deps: OpenCode SDK/plugin 1.19.0 and Pi SDK 1.2.0 as matched sets

Moves the host SDK families together, and supersedes Dependabot's separate bumps of @opencode-ai/plugin, @opencode-ai/sdk and @earendil-works/pi-coding-agent (each failed the typecheck with a second, nested copy).

• OpenCode plugin and SDK 1.18.35 → 1.19.0 together. The plugin pins the SDK exactly, which is why one alone failed. Published .d.ts: plugin declarations unchanged; the SDK only changed a doc comment. Our peer range stays *; E2E and the packed smoke still run against the OpenCode 1.18.18 host.
• Pi SDK family 1.1.0 → 1.2.0 together. pi-agent-core is added as a direct dev dependency at 1.2.0, because pi-coding-agent 1.2.0's ^1.2.0 would otherwise resolve 1.3.0, which pins pi-ai 1.3.0 and recreates the nested copy. No source change was needed: the type changes are re-exports and additions we don't use. Peer range >=0.86.1 <2 is unchanged.
• Dependabot now groups @opencode-ai/* and @earendil-works/*, like the existing @opentui/* group, so each family arrives in one pull request.

Verified with Bun 1.3.14: workspace lock check, all typechecks and builds, Core, OpenCode and Pi suites, the real Pi host tool round-trip, and the packed smoke.

---

Summary by cubic

Updates the OpenCode and Pi host SDK test dependencies as matched sets, because each family can install a nested, type-mismatched copy when its packages are bumped individually.

• OpenCode plugin and SDK move to 1.19.0 together; the plugin pins the SDK exactly, so one alone recreated the nested copy.
• Pi packages (pi-coding-agent, pi-ai, pi-tui) move to 1.2.0, with pi-agent-core 1.2.0 added as a direct dev dependency so pi-coding-agent's ^1.2.0 doesn't resolve to 1.3.0 and pull in a second pi-ai.
• Dependabot now groups @opencode-ai/* and @earendil-works/* so each family arrives in one pull request.
• The 1.19.0 and 1.2.0 type changes are re-exports and additions we don't use, so no source changes; peer ranges and the OpenCode 1.18.18 E2E host are unchanged.