Root opencode.json contamination

Trap: leaving an untracked repository-root opencode.json looks harmless because it is not committed, but BYK/loreai normally has no such file and runtime discovery can let it contaminate cache and authentication tests. Fix: check for and remove or isolate stray root opencode.json before validation.