feat: add ofcx-go provider profile for OpenCode Zen Go DeepSeek V4 Flash

- Add ofcx-go to BackendProfile type union
- Add ofcx-go backend profile spec (Codex app-server stdio)
- Add defaultConfig for ofcx-go (deepseek-v4-flash via Moon Bridge)
- Add Secret mount in deploy.json for runner projection
- Add RBAC access for ofcx-go provider secret
- Update self-test to cover 4 profiles

src/mgr/provider-profiles.ts

@@ -414,6 +414,16 @@ function defaultConfig(profile: BackendProfile): ProfileConfig {
       displayName: "OpenAI",
     };
   }
+  if (profile === "ofcx-go") {
+    return {
+      model: "deepseek-v4-flash",
+      providerName: "opencode",
+      baseUrl: "http://hwlab-deepseek-proxy.hwlab-v02.svc.cluster.local:4000/v1",
+      envKey: "OPENAI_API_KEY",
+      wireApi: "responses",
+      displayName: "OpenCode",
+    };
+  }
   if (profile === "minimax-m3") {
     return {
       model: "MiniMax-M3",