fix(agents): 把 os-dev 的模型钉死为 opus,不再继承 PM 会话模型 (#6686) (#6688)

`.claude/agents/os-dev.md` 的 frontmatter 只有 `name` 与 `description`,没有
`model`。按 Agent 工具的语义,未声明时 agent **继承父会话(PM 座位)的模型** ——
于是「一个 dev 跑在什么模型上」变成了「谁在什么时刻派的它」的函数,而不是这个
角色自身的属性。

这不是推演。2026-08-08 某 PM 座位在自己会话挂在小模型时并行派出四个 dev,四个
全部撞同一堵共享配额墙而死,死在四个不同阶段,其中三个在各自工作树里留下未提交
且完全未经门禁验证的改动。这类失败有两个性质使它比"偶尔跑在小模型上"严重得多:

- **批量性** —— 配额是共享的,撞墙时整批一起死,而不是逐个降级;批次越大损失越大。
- **对派单方不可见** —— PM 的派单前置检查(落点提交、竞态、文件不相交)没有任何
  一条会暴露"这批 dev 将跑在什么模型上"。事故前该座位派过十几个 dev 都没显式传过
  `model`,因为在会话模型正常时这完全看不出问题。

修法是一行 frontmatter。它不牺牲灵活性:Agent 调用上的 `model` 参数**优先于**
定义里的这一行,所以需要别的模型时照常显式传参即可 —— 钉死只消除"静默继承"这一
条失败路径。旁边的 HTML 注释记下成因,免得后来者把它当成冗余行删掉。

⛔ 未改动 agent 定义正文的任何一条指令;`name` / `description` 逐字未动
(frontmatter 以 YAML 解析复核:keys = description/model/name)。
`.claude/` 按 `check-empty-changeset` 自己的判据属"不发布任何东西",故无 changeset。

Fixes #6686


Claude-Session: https://claude.ai/code/session_01AZgRyPVwi1jLb1mNNuUQ9o

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: os-project-manager

.claude/agents/os-dev.md

@@ -6,8 +6,29 @@ description: >
   code, tests, changeset, push, draft PR — and returns a structured JSON
   report to the PM. Use only with a single fully-specified issue as input;
   never for open-ended or multi-issue work.
+model: opus
 ---
 
+<!--
+`model: opus` is pinned deliberately (#6686). Without it this definition declares
+no model, so every dispatched dev INHERITS the PM session's model — making "what
+model does a dev run on" a property of whoever happened to dispatch it, at
+whatever moment, rather than a property of this role.
+
+That is not theoretical. On 2026-08-08 a PM seat dispatched four devs while its
+own session sat on a smaller model; all four died mid-task on the same shared
+quota wall, at four different stages, three of them leaving uncommitted and
+wholly unverified work behind in their worktrees. The failure is BATCHED — one
+exhausted quota takes out the entire batch at once rather than degrading one
+agent — and it is invisible to the dispatcher, whose pre-dispatch checks have no
+reason to ask what model the batch will run on.
+
+If a dispatch genuinely needs a different model, pass `model` on the Agent call:
+that override takes precedence over this line, so pinning here costs nothing and
+removes the silent-inheritance failure mode. Removing this line puts it back.
+-->
+
+
 You are an ObjectStack developer agent. You were dispatched by a PM agent with
 exactly one GitHub issue. Your entire deliverable is that issue implemented,
 pushed as a draft PR, plus the JSON report below as your **final message** —