PENDING: feat(hermes-agent): add OpenCode Go and MiMo-V2.5-Pro deployment profile #671

Parent epic: #668
Depends on: #669, #670

Context

Hermes officially supports provider opencode-go through OPENCODE_GO_API_KEY. OpenCode Go currently includes mimo-v2.5-pro, but provider catalogs, prices, and quotas can change. AWCMS-Mini must model this as desired deployment configuration without receiving or exposing the provider API key.

Objective

Add a validated, provider-neutral model-profile resource with an initial OpenCode Go + MiMo-V2.5-Pro preset and safe operator configuration guidance.

Scope

• Add tenant-scoped awcms_mini_hermes_model_profiles with RLS.
• Initial preset:
  • provider: opencode-go
  • model: mimo-v2.5-pro
  • key env name on Hermes: OPENCODE_GO_API_KEY
• Support optional fallback provider/model metadata.
• Allow versioned non-secret model capability metadata (context/input modality/reasoning flags) marked as observed/configured, not permanently authoritative.
• Store only an opaque credential reference/name; never receive the secret value.
• Add API to list, create, update, validate, and assign a model profile to an agent.
• Generate a masked operator-facing Hermes config.yaml/environment checklist; generated output must contain placeholders only.
• Validate provider/model identifiers and require an explicit revalidation state when catalog metadata becomes stale.
• Do not hardcode current OpenCode subscription quotas or prices as immutable product facts; budget values remain separately configurable.
• Document auxiliary-model and fallback behavior so expensive/unsupported auxiliary tasks do not silently inherit an inappropriate model.

Security requirements

• No OPENCODE_GO_API_KEY value crosses an AWCMS API boundary.
• Secret references are server-rendered/masked.
• Model/profile changes are audited.
• Provider/model changes cannot silently broaden enabled tool capabilities.
• Input modality defaults to text unless live verification explicitly confirms otherwise.

Acceptance criteria

• OpenCode Go/MiMo preset validates to opencode-go + mimo-v2.5-pro.
• Tenant can override the default model without schema/code changes.
• Fallback metadata is optional and clearly reported.
• Generated configuration never contains a real secret.
• Stale/unverified catalog state is visible.
• RLS and ABAC tests prevent cross-tenant profile use.
• OpenAPI, configuration reference, module README, and tests are updated.
• A changeset is added.
• bun run check passes.

Out of scope

• Purchasing/subscribing to OpenCode Go.
• Live provider requests; implemented by the connector/readiness issue.
• Copying Hermes profile files automatically.