config: switch upgrader + report to deepseek, keep supervisor on glm

The weekly /upgrade-all parent session and the /recipe-report session now
run on tinfoil/deepseek-v4-pro (LOOP_MODEL + REPORT_MODEL in upgrader.env).
The hourly supervisor stays on opencode-go/glm-5.2 (SUPERVISOR_MODEL default
in launch-supervisor.py, not overridden). Subagents already bind deepseek via
the cc-ci repo's opencode config (fix from 2026-08-10, verified this week:
all 16 subagents across both waves ran deepseek-v4-pro).

LOOP_TIER=zen is kept so the tier check passes; the watchdog's usage-limit
probe sends the deepseek model name to the zen endpoint, which returns 200
(not 429) → resume immediately — correct, since tinfoil has no rolling usage
limit to wait out. Verified the probe behaviour with a direct curl.

Root cause: the 2026-08-14 run stalled mid-recipe on 'Insufficient balance'
(opencode zen workspace balance exhausted), then sat unfinished for 40h while
the supervisor cron spun hourly unable to recover it. Deepseek (pay-per-use
API key) has no rolling balance limit, so this can't recur.

Also documents the session recovery in JOURNAL.md (the stalled run was
completed via a fresh scoped upgrader — the original 2.58M-token session was
unresumable: the inference endpoint silently drops the oversized request).

nix/hosts/cc-ci-orchestrator-hetzner/configuration.nix

@@ -369,12 +369,15 @@ SSHCFG
       User = "loops"; Group = "users";
       WorkingDirectory = "/srv/cc-ci";
       # Optional per-run overrides for backend/model (LOOP_BACKEND, LOOP_MODEL, OPENCODE_SHARE,
-      # UPGRADER_ARGS, …). The leading "-" makes it optional: absent file → claude/sonnet defaults
-      # (current behavior). To run the weekly job on e.g. opencode-go/glm-5.2, drop a file with
-      #   LOOP_BACKEND=opencode
-      #   LOOP_MODEL=opencode-go/glm-5.2
-      # No rebuild needed to switch — the env file is read at each timer fire. Holds no secrets
-      # (the opencode-go API key lives in ~/.local/share/opencode/auth.json, mode 600).
+      # UPGRADER_ARGS, …). The leading "-" makes it optional: absent file → claude/sonnet defaults.
+      # Current config (as of 2026-08-16): the upgrader + report run on tinfoil/deepseek-v4-pro
+      # (LOOP_MODEL + REPORT_MODEL in the env file); the hourly SUPERVISOR stays on glm-5.2
+      # (SUPERVISOR_MODEL defaults to opencode-go/glm-5.2 in launch-supervisor.py, NOT overridden
+      # here). Subagents bind deepseek via the cc-ci repo's opencode config. LOOP_TIER=zen is kept
+      # so the tier check passes; the watchdog's usage-limit probe sends the deepseek model name to
+      # the zen endpoint, which returns 200 (not 429) → resume immediately (correct: tinfoil has no
+      # rolling usage limit to wait out). No rebuild needed to switch — the env file is read at each
+      # timer fire. Holds no secrets (the tinfoil API key lives in the opencode config / auth.json).
       EnvironmentFile = "-/srv/cc-ci/upgrader.env";
     };
     environment = { HOME = "/home/loops"; CLAUDE_BIN = "/home/loops/.local/bin/claude"; };