cc-ci host: the orchestrator is an opencode agent; no Claude on the box; /secrets convention

Operator 2026-09-07 (evening): Claude sessions stay on notplants-orchestrator;
on the cc-ci host the orchestrator is an opencode agent (agents.toml:
opencode/glm-5.2) steered from https://oc.ci.commoninternet.net, next to the
upgrader/report sessions. claude-install and CLAUDE_BIN are gone from the
modules; launch-upgrader/report print the real UI URL; README "Operating the
orchestrator" rewritten and a "Weekly upgrade run" section added.

Secrets: only cc-ci's, under /secrets/files with runtime paths symlinked
(README §4 table), nothing from other projects — tangled key and the
tailscale line dropped from the host.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

cc-ci-plan/launch-report.py

@@ -124,7 +124,7 @@ def start(mode, date):
         _lu._pin_new_session(_prev_ids)
     if BACKEND == "opencode":
         if OPENCODE_SHARE:
-            log(f"  attached to {OPENCODE_SERVER} → http://oc.commoninternet.net  +public --share link")
+            log(f"  attached to {OPENCODE_SERVER} → https://oc.ci.commoninternet.net  +public --share link")
         # Watchdog for the report too: it runs on glm-5.2 sharing the same opencode-go budget the
         # upgrade run just drained, so a 429 stall is likely. Reuse launch-upgrader.py's watchdog,
         # pointed at THIS (cc-ci-report) session with a report-specific marker + resume prompt. It