fix(ci): run hourly review autofix through NVIDIA NIM

[seonghobae]

Purpose

Migrate the write-capable scheduled OpenCode PR review-autofix agent from GitHub Models to the organization secret NVIDIA_NIM_API_KEY, while preserving the existing read-only review agent's independent credential and model-pool contract.

This pull request is stacked on #731 because #731 establishes the hourly scheduler cadence, one-hour same-head retry, immutable scheduler source binding, and central control-plane baseline.

TDD phase

The first commit adds only the static trust-boundary contract. It must fail against the inherited GitHub Models autofix configuration before the production workflow is changed.

The final contract requires:

• hourly review-fix scheduling inherited from fix(ci): restore central review, security, snapshots, and hourly repair #731;
• OpenCode with only the nvidia-nim provider for scheduled autofix;
• NVIDIA_API_KEY bound from secrets.NVIDIA_NIM_API_KEY only in the agent execution step;
• no GitHub Models token, provider, model, base URL, or USE_GITHUB_TOKEN model-auth fallback in that step; and
• no change to .github/workflows/opencode-review-dispatch.yml or its review-agent key system.

Required before merge

• red contract evidence on the test-only head;
• minimal workflow migration and green focused/full contracts;
• APA 7th standards traceability in docs/doctoring;
• exact-current-head security, review, coverage, and branch-protection gates;
• fix(ci): restore central review, security, snapshots, and hourly repair #731 merged and this branch updated onto protected main.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 9c73a9a6-3871-4f91-8b37-5c0044c73fb6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}