fix(opencode-plugin): update @daytona/sdk to 0.204 to clear high-severity audit findings

[mislavivanda]

Summary

Part of #46 (additional context: a clean install reports high-severity audit findings through @daytona/sdk@0.163.0).

@daytona/sdk@0.163.0 pins outdated @opentelemetry/* transitive deps flagged by npm audit as high severity (GHSA-q7rr-3cgh-j5r3 — Prometheus exporter crash; GHSA-45rx-2jwx-cxfr — JaegerPropagator DoS) with fixAvailable: false at that version.

Note: the issue asked about "0.205", but the latest published version on npm is 0.204.1 — this PR targets ^0.204.1 (same caret convention as before).

Changes

• @daytona/sdk: ^0.163.0 → ^0.204.1 (+ regenerated package-lock.json)

Compatibility verification

• Release notes 0.163.0 → 0.204.1 contain no breaking changes to the API surfaces this plugin uses (Daytona constructor, create/get/delete, process.executeCommand/session commands, createSshAccess, fs.*, state/refreshData); the only breaking change in range is list-secrets pagination (0.194.0), unused here
• tsc --noEmit and full build pass against the new types; no call-site changes needed
• Live smoke test of the exact surfaces (create → fs.createFolder → executeCommand → createSshAccess → refreshData → get → delete) passes identically on 0.163.0 and 0.204.1, run under bun (the runtime OpenCode uses for plugins); test sandbox deleted afterwards
• npm audit --audit-level=high: 0 vulnerabilities after the bump (was 5 high)

---

Summary by cubic

Upgrades @daytona/sdk in the OpenCode plugin from ^0.163.0 to ^0.204.1 to eliminate high‑severity npm audit findings from transitive @opentelemetry/* packages.

• Changes: updates packages/opencode-plugin/package.json and regenerates package-lock.json; no source changes.
• Security impact: old installs showed 5 high‑severity advisories (GHSA-q7rr-3cgh-j5r3, GHSA-45rx-2jwx-cxfr); new installs report 0 high vulnerabilities.
• Compatibility: no breaking changes on the surfaces we use (constructor, create/get/delete, process.executeCommand/session, createSshAccess, fs.*, state/refreshData); list‑secrets pagination breaking change in 0.194.0 is not used.
• Verification: type check and build succeed; smoke test of the exact surfaces passes identically under bun on 0.163.0 and 0.204.1.
• Notes: issue mentioned “0.205”; latest on npm is 0.204.1, so we use ^0.204.1 as before.
• Rollout: run install to refresh lockfile; no migration required for plugin consumers.

^{Written for commit aaa6344. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}