feat: add ofcx-go provider profile for OpenCode Zen Go DeepSeek V4 Flash

- Add ofcx-go to BackendProfile type union
- Add ofcx-go backend profile spec (Codex app-server stdio)
- Add defaultConfig for ofcx-go (deepseek-v4-flash via Moon Bridge)
- Add Secret mount in deploy.json for runner projection
- Add RBAC access for ofcx-go provider secret
- Update self-test to cover 4 profiles

src/common/backend-profiles.ts

@@ -50,6 +50,18 @@ export const backendProfileSpecs: readonly BackendProfileSpec[] = [
     profileIsolation: "profile-scoped-codex-home",
     description: "MiniMax M3 OpenAI-compatible profile through Codex app-server stdio",
   },
+  {
+    profile: "ofcx-go",
+    backendKind: "codex-app-server-stdio",
+    protocol: "codex-app-server-jsonrpc-stdio",
+    transport: "stdio",
+    command: "codex app-server --listen stdio://",
+    status: "registered",
+    requiredSecretKeys: ["auth.json", "config.toml"],
+    defaultSecretName: "agentrun-v01-provider-ofcx-go",
+    profileIsolation: "profile-scoped-codex-home",
+    description: "OpenCode Zen Go DeepSeek V4 Flash profile through Moon Bridge",
+  },
 ];
 
 export const backendProfiles = backendProfileSpecs.map((item) => item.profile) as readonly BackendProfile[];

src/common/types.ts

@@ -28,7 +28,7 @@ export type FailureKind =
 export type RunStatus = "pending" | "claimed" | "running" | "completed" | "failed" | "blocked" | "cancelled";
 export type CommandState = "pending" | "acknowledged" | "completed" | "failed" | "cancelled";
 export type TerminalStatus = "completed" | "failed" | "blocked" | "cancelled";
-export type BackendProfile = "codex" | "deepseek" | "minimax-m3";
+export type BackendProfile = "codex" | "deepseek" | "minimax-m3" | "ofcx-go";
 export type QueueTaskState = "pending" | "running" | "completed" | "failed" | "blocked" | "cancelled";
 export type SessionExecutionState = "idle" | "running" | "terminal";
 export type SessionAttentionState = "active" | "unread" | "read";