feat: add ofcx-go provider profile for OpenCode Zen Go DeepSeek V4 Flash

- Add ofcx-go to BackendProfile type union
- Add ofcx-go backend profile spec (Codex app-server stdio)
- Add defaultConfig for ofcx-go (deepseek-v4-flash via Moon Bridge)
- Add Secret mount in deploy.json for runner projection
- Add RBAC access for ofcx-go provider secret
- Update self-test to cover 4 profiles

deploy/deploy.json

@@ -56,6 +56,15 @@
           "profile": "minimax-m3",
           "readOnly": true,
           "writableCopy": true
+        },
+        {
+          "name": "ofcx-go-secret-projection",
+          "secretRef": { "name": "agentrun-v01-provider-ofcx-go", "keys": ["auth.json", "config.toml"] },
+          "projectionPath": "/var/run/agentrun/secrets/ofcx-go-0",
+          "runtimeCopyPath": "/home/agentrun/.codex-ofcx-go",
+          "profile": "ofcx-go",
+          "readOnly": true,
+          "writableCopy": true
         }
       ],
       "env": [