nix ci red on main: proxy-port guard misses muse/commandcode proxies — opencode.jsonc hardcodes 18747/18748 #866

Problem

nix ci (treefmt job) fails on main since the fleet proxy/config commits (a936e16, f574927, 187da70):

• .github/scripts/check-proxy-port-fallbacks.sh fails with: .opencode/opencode.jsonc hardcodes a literal proxy port — use {env:<VAR>:-<port>} so the copies cannot drift (#435).
• Verified on main a480b6a and 7ce0d74: nix ci runs 40182802819 / 40183235188 FAILURE; the same failure hits unrelated PRs branched from current main (e.g. PR fix(id-web): needsRefresh treats non-numeric/future stored timestamps as stale (#847) #857's fresh treefmt run 40182863546).

Root cause

home/common/default.nix gained two proxies — museProxyPort = 18747 and commandcodeProxyPort = 18748 — whose scripts already use the guarded pattern (bin/muse-proxy.mjs:32 parseProxyPort('MUSE_PROXY_PORT', 18747), bin/commandcode-proxy.mjs:58 parseProxyPort('COMMANDCODE_PROXY_PORT', 18748), session var COMMANDCODE_PROXY_PORT at default.nix:614), but:

1. the guard script's proxy table still lists only the original five, so the two new ports are never checked, and
2. .opencode/opencode.jsonc keeps literal ports: the live commandcode provider baseURL (line 4216, 127.0.0.1:18748) and the commented-out muse provider baseURL (line 4149, 127.0.0.1:18747), both matching the guard's literal-port grep.

Fix (in the sweep PR)

• Add MUSE_PROXY_PORT and COMMANDCODE_PROXY_PORT rows to the guard's proxy table.
• opencode.jsonc: use {env:MUSE_PROXY_PORT:-18747} (commented muse provider) and {env:COMMANDCODE_PROXY_PORT:-18748} (commandcode provider).

Acceptance

• bash .github/scripts/check-proxy-port-fallbacks.sh passes (7 proxies).
• nix ci treefmt job green on main again.