fix: Docker deploys run the promised OpenRouter default (HARNESS_MODEL scoped to open_code)

[AbirAbbas]

Summary

An OpenRouter-only Railway/Docker deployment silently ran openrouter/moonshotai/kimi-k2.6 instead of the documented default openrouter/deepseek/deepseek-v4-flash-0731. Root cause: the images bake ENV HARNESS_MODEL=openrouter/moonshotai/kimi-k2.6 (needed so OpenCode's small_model config interpolation always has a value), and the model-resolution env cascade (SWE_DEFAULT_MODEL → AI_MODEL → HARNESS_MODEL) treated that baked value as deployer intent — for every runtime. That also pushed the openrouter/… id into the claude_code/codex CLIs on Docker deploys (the README documented the codex ~13s PM failure as a caveat instead of fixing it).

Found while smoke-testing the agentfield-engineering-team Railway template: the plan phase ran kimi-k2.6 on a deploy whose only model-relevant env var was OPENROUTER_API_KEY.

Changes (one commit per concern)

1. fix(docker) — both images now bake HARNESS_MODEL=openrouter/deepseek/deepseek-v4-flash-0731, matching _OPENROUTER_AUTO_DEFAULT_MODEL / openRouterAutoDefaultModel and the README.
2. fix(models) — the cascade consults HARNESS_MODEL only on the open_code runtime, in both nodes (Python + Go; main path, fast path, planning default). SWE_DEFAULT_MODEL / AI_MODEL keep steering every runtime. README + .env.example updated; the codex SWE_DEFAULT_MODEL caveat is gone because the failure mode is gone.

Validation contract → tests

• OpenRouter-only Docker deploy resolves every role to openrouter/deepseek/deepseek-v4-flash-0731 → Dockerfile↔constant drift guard (TestDockerfileHarnessModelDefault), existing open_code cascade tests unchanged.
• HARNESS_MODEL still steers open_code (main + fast) → existing tests + test_harness_model_scoped_to_open_code_in_fast, TestFastResolveModels_HarnessModelScopedToOpenCode.
• claude_code/codex ignore HARNESS_MODEL and keep runtime defaults → test_harness_model_ignored_on_claude_code / _on_codex, TestResolveRuntimeModels_HarnessModelScopedToOpenCode.
• SWE_DEFAULT_MODEL/AI_MODEL still apply to every runtime → test_swe_default_model_still_applies_on_claude_code + Go assertions.

Test plan

• make check (pytest full suite): 1214 passed, 1 skipped (Python 3.12, pip install -e ".[dev]" per CI)
• go vet ./... && go test -race -count=1 ./... in go/: clean
• gofmt -l clean on touched files
• After merge: redeploy the Railway template with only OPENROUTER_API_KEY and confirm the PM reasoner logs deepseek-v4-flash-0731

---

🤖 Generated with Claude Code