config: subagents -> opencode/deepseek-v4-flash (zen endpoint, not tinfoil)

Route deepseek-v4-flash through the opencode zen subscription endpoint
(opencode/deepseek-v4-flash) instead of tinfoil pay-per-use. The zen
subscription is already paid for; flash consumes the balance far more
slowly than glm-5.2 did (flash cost ~$0.0000002/tok vs glm's higher rate),
so a full weekly run is much less likely to exhaust the balance — and
the operator has reset it.

Completes the fleet-wide move: upgrader parent (LOOP_MODEL) + report
(REPORT_MODEL) in upgrader.env, and this PR sets the subagents. Supervisor
stays on opencode-go/glm-5.2.

Verified: zen endpoint serves deepseek-v4-flash (HTTP 200, 1.2s).

cc-ci-plan/upstream/gitea.md

@@ -0,0 +1,19 @@
+# gitea upstream sources
+
+## gitea/gitea
+- image: gitea/gitea
+- source: https://github.com/go-gitea/gitea
+- releases: https://github.com/go-gitea/gitea/releases
+- security: https://blog.gitea.com/
+
+## postgres
+- image: postgres
+- source: https://github.com/postgres/postgres
+- releases: https://www.postgresql.org/docs/release/
+- security: https://www.postgresql.org/support/security/
+
+## mariadb
+- image: mariadb
+- source: https://github.com/MariaDB/server
+- releases: https://mariadb.com/kb/en/release-notes/
+- security: https://mariadb.com/kb/en/security/

opencode.json

@@ -2,7 +2,7 @@
   "$schema": "https://opencode.ai/config.json",
   "agent": {
     "general": {
-      "model": "opencode/deepseek-v4-pro"
+      "model": "opencode/deepseek-v4-flash"
     }
   }
 }