agents: fix review findings — thread attribution, races, rescue stall, docs, CI

Fixes from a full repo review:

- fetch-thread.sh: attribute每 comment to its REAL author (@pm/@qa/… — agents
  post as their own users now); the old "🤖 @name line at the top" hint pointed
  at headers we removed, leaving every teammate comment anonymous. Also strip
  the hidden loop-prevention marker from bodies (prompt noise).
- agent.yml: per-issue concurrency group (queued, no cancel) — two quick
  comments on one issue no longer race the same ai/issue-N branch.
- rescue-pr.sh: after opening a rescue PR, hand it back into the flow with an
  unmarked @pm trigger (the pm→qa choreography previously stalled silently on
  any rescued run); drop the old "🤖 **@name**" header style; add ops to the
  token case; mark the status note with the hidden marker.
- README: token table said "@qa merges / TOKEN_QA needs write:repository" —
  inverted since the PM-orchestrated flow (@pm merges, autopilot only; @qa is
  read-only). Updated the agent table (descs, node1-ssh moved to homelab) and
  added a "How a task flows" section.
- agents.json: pm/qa descs now describe the orchestrator/reviewer roles (these
  feed the roster prompt agents route by).
- NEW ci.yml: bash -n + shellcheck(-S error) on every script, YAML-parse on
  every workflow, agents.json schema check — the ${x:-{}} brace bug would have
  been caught here before it shipped.
- install-opencode.sh: pin opencode (default 1.17.13, override via
  OPENCODE_VERSION) — a breaking release no longer takes down every agent.
- build-activity-log.sh: ollama/ollama-cloud models are subscription-billed
  (no $/token exists) — label the footer "subscription" instead of a
  misleading $0.0000; metered (anthropic) models keep the real dollar cost.
- route.sh: document that mention-priority is list-order and load-bearing for
  the flow's trigger comments.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/scripts/route.sh

@@ -27,6 +27,10 @@ cp "$AGENTS_JSON" /tmp/agents.json
 # here — see agent.yml: this reusable workflow sees it as 'workflow_call'.)
 if [ -n "$CID" ]; then scan="$BODY"; else scan="$IBODY"; fi
 name=""
+# FIRST MATCH IN THIS LIST ORDER WINS when a comment mentions several agents. The order is
+# load-bearing for the flow's trigger comments: "@pm — @qa approved …" must route to @pm (pm is
+# checked first), while "@junior please address @qa's review …" must route to the dev (devs are
+# checked before qa). If you add an agent or reword a trigger in publish.sh, re-check this order.
 for a in pm junior senior lead qa ops; do
   case "$scan" in *"@$a"*) name=$a; break;; esac
 done