Use the shared DAG-aware JSON generator for programs.opencode.settings so order-sensitive permission rules can be expressed with lib.hm.dag entries. Add a focused NMT test for last-match-wins permission output and news for existing opencode users.
