orchestrator: run on the opencode backend + auto-start on boot

Switch the cc-ci-orchestrator agent (cc-ci-plan/agents.toml) from the claude
backend to the opencode backend so it attaches to the shared opencode web
server (opencode-web.service, 127.0.0.1:4096) and is reachable for Remote
Control at https://oc.commoninternet.net under the /srv/cc-ci-orch project.
Model = opencode/glm-5.2 (same provider family as the weekly upgrader /
supervisor). resume=false — the opencode backend has no --resume equivalent
(a fresh session per launch, matching the existing launch-opencode.sh shape).

Add a cc-ci-orchestrator.service systemd unit so on boot it runs
'agents.py up orchestrator' after opencode-web.service is up — the same
reboot-resilience shape lichen-orchestrator / project-orchestrator already
have. KillMode=process so a rebuild that merely touches this unit does not
tear down the shared tmux server and every agent session with it.

No secrets: the diff is only config + comments (paths, model names, unit
definition).

cc-ci-plan/agents.toml

@@ -53,8 +53,9 @@ log_dir = "/srv/cc-ci/.cc-ci-logs"
 [[agent]]
 name    = "orchestrator"       # tmux session: cc-ci-orchestrator
 kind    = "persistent"
-model   = "claude-opus-4-8"
+backend = "opencode"           # attached to the shared opencode web server (oc.commoninternet.net)
-resume  = true                 # claude --resume <state/orchestrator.id>
+model   = "opencode/glm-5.2"   # opencode backend; visible at https://oc.commoninternet.net
+resume  = false                # opencode backend has no --resume equivalent (fresh session each launch)
 watch   = "heal"               # restart if dead / FATAL / backend-mismatch; never stall-reboot
 wake    = { interval = 3600, prompt_file = "ai-progress-monitor-prompt.txt" }
 prompt  = """

nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix

@@ -258,6 +258,40 @@ SSHCFG
     '';
   };
 
+  # cc-ci-orchestrator supervisor — the operator's steering session. Same shape as
+  # lichen-orchestrator / project-orchestrator above: this unit only LAUNCHES the orchestrator's
+  # tmux session via the agent-orchestrator harness (cc-ci-plan/agents.py); it does not own the
+  # session or the tmux server. The orchestrator agent is declared in cc-ci-plan/agents.toml on
+  # the OPencode backend (backend = "opencode", model = "opencode/glm-5.2"), so on boot it
+  # attaches to the shared opencode web server (opencode-web.service below) and is reachable for
+  # Remote Control at https://oc.commoninternet.net under the /srv/cc-ci-orch project. The harness
+  # watchdog (started by `agents.py up`) keeps it alive: heal-only (no stall reboots — a persistent
+  # supervisor must not be killed just for idling). Added 2026-08-03 to give the cc-ci orchestrator
+  # the same reboot-resilience the other two orchestrators already have.
+  systemd.services.cc-ci-orchestrator = {
+    description = "cc-ci orchestrator (operator steering session) — agents.py up orchestrator, opencode backend";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network-online.target" "tailscaled.service" "opencode-web.service" ];
+    wants = [ "network-online.target" ];
+    serviceConfig = {
+      # KillMode=process: see the note on cc-ci-loops — a rebuild that merely touches this unit
+      # must not tear down the (shared) tmux server and every agent session with it.
+      KillMode = "process";
+      Type = "oneshot"; RemainAfterExit = true;
+      User = "loops"; Group = "users";
+      WorkingDirectory = "/srv/cc-ci-orch";
+    };
+    environment = { HOME = "/home/loops"; };
+    path = [ pkgs.bash pkgs.tmux pkgs.git pkgs.python3 pkgs.openssh pkgs.nettools ];
+    script = ''
+      export PATH="/home/loops/.local/bin:$PATH"
+      proj="/srv/cc-ci-orch"
+      echo "$(cat /proc/sys/kernel/random/boot_id) boot $(date -u +%FT%TZ) — cc-ci-orchestrator up" \
+        >> "$proj/cc-ci-plan/.ao-boot.log" 2>/dev/null || true
+      cd "$proj" && python3 cc-ci-plan/agents.py up orchestrator || echo "cc-ci orchestrator agents.py up failed"
+    '';
+  };
+
   # p-lichen-orchestrator supervisor — the SEPARATE lichen.page testing/hardening orchestrator
   # (distinct from cc-ci-loops above). Reboot-resilience: on boot, resume the orchestrator's Remote
   # Control session + watchdog + pipeline via `engine/agents.py up`. Added 2026-07-08 after a reboot