[Ticket]: review / opencode fails on an Unauthorized LLM credential — the AI review gate is silently not running

## Type

Bug / CI reliability

## Summary

The `review / opencode` job fails on **`APIError: Unauthorized`** from `https://api.ai.camer.digital/v1/chat/completions`. The `CAMER_DIGITAL_API_KEY` secret is being rejected by the provider, so the automated AI review never produces a verdict — it reads the PR diff, then dies at the first model call and posts `🤖 Review failed`.

This is not an occasional blip: **6 of the last 12 runs failed**, across unrelated branches.

## Intent

The estate's AI-governance posture leans on this job as a review surface. While the credential is dead, PRs merge with **no AI review having run at all**, and the failure looks like an ordinary red check — so it either gets ignored (eroding the meaning of a red check) or blocks people who don't know it is environmental. Both outcomes are worse than the job not existing.

## Source of truth (links)

- Failing run on #433: https://github.com/ADORSYS-GIS/converse-frontends/actions/runs/33399508717/job/99512109573
- `.github/workflows/opencode.yml`

## Current Behavior

```
APIError: Unauthorized
##[error]APIError: Unauthorized
##[error]Process completed with exit code 1
metadata: { url: "https://api.ai.camer.digital/v1/chat/completions" }
```

Recent history (`gh run list --workflow=opencode.yml --limit 12`), 2026-08-31:

```
failure chore/cratestack-0.10-upgrade
failure docs/rewrite-architecture-knowledge
success docs/authz-ui-diagrams
success docs/authz-ui-architecture
success main
success main
failure feat/authz-ui-routes
failure feat/authz-ui-pages
failure claude/admin-estate-scope-all
failure claude/admin-cards
success claude/logo-aspect
success claude/branding-theme-logos
```

The interleaving of success and failure suggests quota/rate limiting on the key rather than a plain revocation — worth confirming with the provider before simply reissuing.

## Expected Behavior

Either the job completes and posts a review, or — if the provider is unavailable — it fails in a way distinguishable from "this diff has problems."

## Acceptance Criteria

- [ ] `CAMER_DIGITAL_API_KEY` is valid; `review / opencode` completes and posts a review on a test PR.
- [ ] If the root cause is quota rather than an invalid key, the quota/plan is resolved or the model is switched, and the finding is recorded here.
- [ ] A provider/auth failure is **visibly distinct** from a review that found problems — e.g. the job posts "review could not run (provider unavailable)" and, if it is not meant to gate merges, does not present as a plain red check.
- [ ] An explicit decision is recorded: is `review / opencode` advisory or blocking? Today `main` has no branch protection, so it is de facto advisory while looking mandatory.

## Out of Scope

- Replacing opencode with a different review tool.
- Adding branch protection to `main` (separate decision).

## Risks

Leaving it red trains everyone to merge past red checks — which is exactly how a real failure gets waved through. This already happened once knowingly: #433 was merged with this job red, after confirming the failure was environmental and repo-wide.

## Verification evidence

Diagnosed 2026-08-31 from the run log above and the 12-run history. The `Unauthorized` response is from the model provider, not from GitHub — the job's checkout, diff-reading and tool calls all succeeded first, so repo permissions are not implicated.

**Not yet verified:** whether the key is revoked, expired, or rate-limited. That needs someone with provider access — I cannot inspect or rotate the secret.

## Human accountable owner

@stephane-segning

## AI Usage Declaration

AI-assisted — diagnosis and drafting by Claude Opus 5 (Claude Code), from real run logs while merging #433. Quoted output is verbatim.

## Human verification completed

- [ ] I am the accountable owner and accept responsibility for this ticket.

**Left unticked deliberately** — the owner's assertion to make. Secret rotation requires provider access the agent does not have.