agents: fix review findings — thread attribution, races, rescue stall, docs, CI

Fixes from a full repo review:

- fetch-thread.sh: attribute每 comment to its REAL author (@pm/@qa/… — agents
  post as their own users now); the old "🤖 @name line at the top" hint pointed
  at headers we removed, leaving every teammate comment anonymous. Also strip
  the hidden loop-prevention marker from bodies (prompt noise).
- agent.yml: per-issue concurrency group (queued, no cancel) — two quick
  comments on one issue no longer race the same ai/issue-N branch.
- rescue-pr.sh: after opening a rescue PR, hand it back into the flow with an
  unmarked @pm trigger (the pm→qa choreography previously stalled silently on
  any rescued run); drop the old "🤖 **@name**" header style; add ops to the
  token case; mark the status note with the hidden marker.
- README: token table said "@qa merges / TOKEN_QA needs write:repository" —
  inverted since the PM-orchestrated flow (@pm merges, autopilot only; @qa is
  read-only). Updated the agent table (descs, node1-ssh moved to homelab) and
  added a "How a task flows" section.
- agents.json: pm/qa descs now describe the orchestrator/reviewer roles (these
  feed the roster prompt agents route by).
- NEW ci.yml: bash -n + shellcheck(-S error) on every script, YAML-parse on
  every workflow, agents.json schema check — the ${x:-{}} brace bug would have
  been caught here before it shipped.
- install-opencode.sh: pin opencode (default 1.17.13, override via
  OPENCODE_VERSION) — a breaking release no longer takes down every agent.
- build-activity-log.sh: ollama/ollama-cloud models are subscription-billed
  (no $/token exists) — label the footer "subscription" instead of a
  misleading $0.0000; metered (anthropic) models keep the real dollar cost.
- route.sh: document that mention-priority is list-order and load-bearing for
  the flow's trigger comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,56 @@
+name: ci
+run-name: "ci · ${{ github.event.pull_request.title || github.sha }}"
+# Lint the very scripts every agent run executes. A single unchecked shell bug here breaks ALL
+# agents in ALL repos at once (e.g. the ${VAR:-{}} brace bug shellcheck flags as SC1083/SC2321),
+# so PRs must pass: bash -n + shellcheck on every script, YAML-parse on every workflow, and a
+# schema check on agents.json (the routing registry).
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  lint:
+    runs-on: ci-runner
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install linters
+        run: |
+          command -v shellcheck >/dev/null || (apt-get update -qq && apt-get install -y -qq shellcheck) || \
+            sudo sh -c 'apt-get update -qq && apt-get install -y -qq shellcheck' || true
+          python3 -c 'import yaml' 2>/dev/null || pip3 install --quiet pyyaml || \
+            (apt-get install -y -qq python3-yaml || sudo apt-get install -y -qq python3-yaml) || true
+
+      - name: bash -n (syntax) — every script
+        run: |
+          set -e
+          for f in .gitea/workflows/scripts/*.sh; do bash -n "$f" && echo "OK $f"; done
+
+      - name: shellcheck — every script
+        run: |
+          set -e
+          if command -v shellcheck >/dev/null; then
+            # error-severity only: the scripts intentionally use unquoted word-splitting in places;
+            # errors (real breakage like the ${x:-{}} brace bug) must fail the build.
+            shellcheck -S error .gitea/workflows/scripts/*.sh && echo "shellcheck clean (severity=error)"
+          else
+            echo "shellcheck unavailable on runner — skipped"
+          fi
+
+      - name: YAML-parse every workflow
+        run: |
+          set -e
+          python3 - <<'EOF'
+          import glob, sys, yaml
+          for f in sorted(glob.glob('.gitea/workflows/*.yml')):
+              yaml.safe_load(open(f))
+              print('OK', f)
+          EOF
+
+      - name: Validate agents.json (registry schema)
+        run: |
+          set -e
+          jq -e 'to_entries | all(.value | (.model|type=="string") and (.mode=="pr" or .mode=="comment")
+                 and (.vision|type=="boolean") and (.skills|type=="array") and (.desc|type=="string"))' \
+            .gitea/workflows/scripts/agents.json >/dev/null && echo "agents.json OK"