feat(analysis): add local agent runners and OpenCode

[lesbass]

What does this PR do?

Adds an extensible analysis runner selector so Code Insights can reuse locally authenticated Claude Code, Codex, or OpenCode installations instead of requiring a separate API key. It also adds OpenCode Zen/Go as a remote provider and refreshes the suggested OpenAI, Anthropic, and Gemini model catalogs.

• Adds --runner api|claude|codex|opencode; keeps --native as a Claude-compatible alias.
• Passes runner and model selection through insights, SessionEnd hooks, and queued analysis.
• Runs Codex ephemerally in a read-only sandbox with JSON Schema output.
• Runs OpenCode in an isolated temporary directory with tools denied and parses its JSONL event stream.
• Adds remote OpenCode Zen/Go configuration with API key, model, base URL, protocol-aware dispatch, and live /models discovery.
• Allows arbitrary custom model IDs in both interactive CLI and dashboard configuration.
• Updates recommended models to current OpenAI GPT-5.6, Anthropic Claude 5, and Gemini 3.x families.
• Updates user and product documentation.

Type of change

• Bug fix
• New feature
• Provider support (new source tool)
• Documentation
• Refactor / internal improvement

Related issue

Closes #315

Test plan

• Ran pnpm test — all tests pass (CLI 587, dashboard 15, server 583)
• Ran pnpm build — no build errors
• Manually tested with real session data

Manual integration checks:

• OpenCode Go (opencode-go/deepseek-v4-flash) accepted stdin in non-interactive JSON mode and returned the expected JSONL text event with all permissions denied.
• Codex CLI ran ephemerally in a temporary read-only workspace and produced output conforming to the supplied JSON Schema.
• opencode models opencode-go returned the current authenticated Go catalog.

Notes for reviewer

The existing AnalysisRunner abstraction is retained. runner_type = native queue rows remain supported and normalize to Claude, so existing installations do not need a database migration.

The OpenCode remote client selects the endpoint shape from the model family: Responses for GPT models, Messages for Claude/Minimax/Qwen models, and OpenAI-compatible Chat Completions for the remaining Zen/Go catalog. The base URL remains customizable.

Local agent token counts remain zero in analysis_usage, matching the existing Claude native behavior because those calls are accounted for by the agent subscription rather than a Code Insights API key.