agents: fix review findings — thread attribution, races, rescue stall, docs, CI

Fixes from a full repo review:

- fetch-thread.sh: attribute每 comment to its REAL author (@pm/@qa/… — agents
  post as their own users now); the old "🤖 @name line at the top" hint pointed
  at headers we removed, leaving every teammate comment anonymous. Also strip
  the hidden loop-prevention marker from bodies (prompt noise).
- agent.yml: per-issue concurrency group (queued, no cancel) — two quick
  comments on one issue no longer race the same ai/issue-N branch.
- rescue-pr.sh: after opening a rescue PR, hand it back into the flow with an
  unmarked @pm trigger (the pm→qa choreography previously stalled silently on
  any rescued run); drop the old "🤖 **@name**" header style; add ops to the
  token case; mark the status note with the hidden marker.
- README: token table said "@qa merges / TOKEN_QA needs write:repository" —
  inverted since the PM-orchestrated flow (@pm merges, autopilot only; @qa is
  read-only). Updated the agent table (descs, node1-ssh moved to homelab) and
  added a "How a task flows" section.
- agents.json: pm/qa descs now describe the orchestrator/reviewer roles (these
  feed the roster prompt agents route by).
- NEW ci.yml: bash -n + shellcheck(-S error) on every script, YAML-parse on
  every workflow, agents.json schema check — the ${x:-{}} brace bug would have
  been caught here before it shipped.
- install-opencode.sh: pin opencode (default 1.17.13, override via
  OPENCODE_VERSION) — a breaking release no longer takes down every agent.
- build-activity-log.sh: ollama/ollama-cloud models are subscription-billed
  (no $/token exists) — label the footer "subscription" instead of a
  misleading $0.0000; metered (anthropic) models keep the real dollar cost.
- route.sh: document that mention-priority is list-order and load-bearing for
  the flow's trigger comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/agent.yml

@@ -6,8 +6,14 @@ on:
   workflow_call:
 
 jobs:
-  
+
   agent:
+    # One run at a time PER ISSUE: two quick comments on the same issue would otherwise race —
+    # both checking out ai/issue-N, pushing (non-fast-forward loss) and double-posting. Queued
+    # runs wait (no cancel) so every trigger is still processed, just serially.
+    concurrency:
+      group: ai-agent-${{ github.repository }}-${{ github.event.issue.number }}
+      cancel-in-progress: false
     # Trusted author only, and only when a known agent is mentioned. This gate is the main
     # defense against malicious-issue prompt injection — do not loosen it.
     if: >
@@ -190,6 +196,7 @@ jobs:
         env:
           SCRIPTS: ${{ runner.temp }}/agents-scripts
           MODE: ${{ steps.prep.outputs.mode }}
+          MODEL: ${{ steps.prep.outputs.model }}   # ollama-cloud models are subscription-billed (no $/token)
         run: bash "$SCRIPTS/build-activity-log.sh"
 
       - name: Publish — PR (dev agents) or comment (pm), always reply in the issue