feat(hermes): switch the primary model to Claude Opus 5

The Codex weekly limit is close, so make anthropic/claude-opus-5 primary and
demote openai-codex to first fallback with the local gpt-oss:20b behind it.

The credential is a Claude subscription OAuth token, not an API key. The
anthropic provider resolves ANTHROPIC_API_KEY, then ANTHROPIC_TOKEN, then
CLAUDE_CODE_OAUTH_TOKEN, so the OAuth token must arrive under the last name
to be treated correctly. Marked optional so Hermes still starts and falls
back if the Secret is absent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

services/hermes/configmap.yaml

@@ -9,11 +9,13 @@ metadata:
 data:
   config.yaml: |
     model:
-      provider: openai-codex
+      provider: anthropic
-      default: gpt-5.6-terra
+      default: claude-opus-5
-      model: gpt-5.6-terra
+      model: claude-opus-5
 
     fallback_providers:
+      - provider: openai-codex
+        model: gpt-5.6-terra
       - provider: custom
         model: gpt-oss:20b
         base_url: http://hermes-model-gate.hermes.svc.cluster.local:11434/v1

services/hermes/deployment.yaml

@@ -211,6 +211,19 @@ spec:
               value: https://scm.bstein.dev
             - name: GRAFANA_BASE_URL
               value: https://metrics.bstein.dev
+            # Claude subscription OAuth token (sk-ant-oat01...). The anthropic
+            # provider accepts ANTHROPIC_API_KEY, ANTHROPIC_TOKEN, or this, in
+            # that order; an OAuth token is not an API key, so it must arrive
+            # under this name. Optional, so Hermes still starts without it and
+            # falls back to openai-codex.
+            # TODO: migrate to Vault alongside the Gitea token; this manual
+            # Secret was created in the interest of demo time.
+            - name: CLAUDE_CODE_OAUTH_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: hermes-anthropic-token
+                  key: token
+                  optional: true
           volumeMounts:
             - name: home
               mountPath: /opt/data