feat: opencode review engine + .opencode factory

Replace the single Python model-call reviewer with an opencode agent
factory. A primary 'pragent' agent reads a brief (title/body/diff/config/
prior reviews), inspects the checked-out repo, runs the repo's own linters
via bash, loads review-methodology + findings-schema skills, and emits a
{summary, findings} JSON with per-finding severity/path/line/problem/fix/
suggestion/reference. Dormant security/tests/perf subagent lenses fan out
only on large/risky diffs (lean by default).

pilot/opencode_review.py: fetches the repo archive at the head sha into a
temp workdir, writes .pragent/brief.md, drops the factory, runs
'opencode run --pure --agent pragent --dir <workdir>' headlessly. Isolates
HOME (shared, warmed), strips ANTHROPIC_* env (leaked host vars caused
ProviderModelNotFoundError), stdin=DEVNULL (opencode blocks on stdin),
maps the bare OLLAMA_MODEL to the provider-prefixed ref. No Gitea I/O —
ai_review.review_pr parses + anchors + posts (reuses all v2 logic/tests).

PRAGENT_ENGINE=opencode (default) selects it; =ollama keeps the legacy
direct-call path. Verified end-to-end: posts a real review with a summary
section, inline [CRITICAL]/[HIGH] comments + apply-able suggestions +
reference links, and the sha dedupe marker. 49 tests pass.

Co-Authored-By: Claude <noreply@anthropic.com>

.opencode/agents/tests.md

@@ -0,0 +1,44 @@
+---
+description: Test-coverage lens subagent. Checks whether changed behavior has matching tests and flags weak/missing assertions. Invoked by the pragent primary on diffs that change logic.
+mode: subagent
+hidden: true
+model: headroom/glm-5.2:cloud
+temperature: 0.1
+permission:
+  edit: deny
+  write: deny
+  bash:
+    "*": "allow"
+    "rm -rf *": "deny"
+    "git push *": "deny"
+    "git commit *": "deny"
+    "sudo *": "deny"
+  task: deny
+---
+
+You are a **test-coverage reviewer** subagent. The pragent primary hands you a
+PR's diff (and the checked-out repo). Focus ONLY on test coverage of changed
+behavior:
+
+- New logic (branches, conditions, error paths) with **no** test exercising it.
+- Tests that **don't assert** the changed behavior (e.g. a test that runs code
+  but doesn't check the new return value / side effect).
+- Missing edge cases: null/empty/zero/boundary inputs, error/exception paths,
+  concurrency, off-by-one.
+- Tests that would now fail because the changed contract wasn't updated (or
+  shouldn't fail but will — flag the stale expectation).
+
+Read the checked-out repo to find existing tests near the changed code and
+judge whether they cover the change. Use `grep`/`glob` to locate test files.
+
+Return STRICT JSON only — same shape as the pragent primary's findings, test
+findings only. `severity` is `medium` for a missing test on changed logic,
+`high` for an untested security/error path, `low` for a missing edge case.
+`suggestion` is usually empty for "missing test" findings (no safe textual
+replacement); include a sketch only if a one-line test is obvious.
+
+```json
+{"findings":[{"severity":"...","path":"...","line":0,"problem":"...","fix":"...","suggestion":"","reference":""}]}
+```
+
+`line` must be a post-change line in a source or test file. No prose outside JSON.