chore: Upgrade Bun one final time (rust?) - #27648

opencode pin:
- inputs.opencode -> github:anomalyco/opencode/v1.15.9 (upstream moved
  from sst/opencode to anomalyco/opencode mid-v1.15.x).
- Three kfactory patches re-diffed via the 5-tree workflow: only
  workspace-branch had a real conflict (v1.15.9 added an upstream
  `import { notFound }` mid-import-block which broke hunk #1 context);
  bearer-and-routing + kfactory-refresh changed only blob hashes + a
  handful of line offsets.
- Worked around upstream's wrong x86_64-linux hash in nix/hashes.json
  (recurring CI race tracked at anomalyco/opencode#18227) by overriding
  node_modules via `opencode.packages.${system}.node_modules_updater`
  with the correct sha256 derived via the awk recipe in the comment.
  Single-platform pin; drop the .override block when upstream stabilises.

Docs:
- rules/020-patches.md split into three files (stack identity in 020,
  re-diff workflow in 021, bumping playbook in 022) per
  .claude/rules/000-meta.md's 100-line guideline. Cross-references
  between them keep the workflow discoverable from any entry point.
- 022 documents the hashes.json workaround + per-platform caveat + how
  to verify it can be dropped on a future bump.
- flake.nix `patches.*` consumer docstring now warns that the embedded
  hash is v1.15.9-specific (copy-paste only works for that exact pin)
  and that the .override recipe requires the consumer's opencode flake
  to expose `node_modules_updater` (anomalyco fork + descendants only).
- Two adjacent @warnings in flake.nix labelled parenthetically:
  `@WARNING (hashes.json):` vs `@WARNING (patch order):`.
- CLAUDE.md layout block fixed: was `ci.yml (two-job ...)`, now
  `check.yml (single job ...)` matching the actual workflow file
  and the new CI shape.
- docs/spec.md: anomalyco/opencode#27648 -> anomalyco/opencode#27648,
  v1.15.7 -> v1.15.9 mention. v1.15.9 still has both v1 message and
  v2 session_message tables (verified), so the heal targets both.

CI:
- check.yml collapsed from two jobs (quality + build, each running
  `nix flake check`) to one job. Same secret-isolation property
  preserved via a step-level `if: push-to-default-branch` on the
  Attic setup step. GHA semantics: a step's post-hook is skipped iff
  its main step's `if:` evaluated false, so attic-action only pushes
  when the gate passed.
- Attic setup placed AFTER the lint/test gates, restoring the old
  "linters pass before secrets touch disk" property of the two-job
  shape (on push-to-default, attic config now only lands on disk
  after every linter + test passed).

Verified: `nix flake check` (19 checks), `actionlint`, `zizmor`,
`alejandra`, `deadnix`, `betterleaks`, `golangci-lint`, `gofmt`,
`go test`.

Co-Authored-By: Claude Opus 4.7 <[email protected]>