feat: add ofcx-go provider profile for OpenCode Zen Go DeepSeek V4 Flash

- Add ofcx-go to BackendProfile type union
- Add ofcx-go backend profile spec (Codex app-server stdio)
- Add defaultConfig for ofcx-go (deepseek-v4-flash via Moon Bridge)
- Add Secret mount in deploy.json for runner projection
- Add RBAC access for ofcx-go provider secret
- Update self-test to cover 4 profiles

src/common/backend-profiles.ts

@@ -50,6 +50,18 @@ export const backendProfileSpecs: readonly BackendProfileSpec[] = [
     profileIsolation: "profile-scoped-codex-home",
     description: "MiniMax M3 OpenAI-compatible profile through Codex app-server stdio",
   },
+  {
+    profile: "ofcx-go",
+    backendKind: "codex-app-server-stdio",
+    protocol: "codex-app-server-jsonrpc-stdio",
+    transport: "stdio",
+    command: "codex app-server --listen stdio://",
+    status: "registered",
+    requiredSecretKeys: ["auth.json", "config.toml"],
+    defaultSecretName: "agentrun-v01-provider-ofcx-go",
+    profileIsolation: "profile-scoped-codex-home",
+    description: "OpenCode Zen Go DeepSeek V4 Flash profile through Moon Bridge",
+  },
 ];
 
 export const backendProfiles = backendProfileSpecs.map((item) => item.profile) as readonly BackendProfile[];