fix: opencode config

opencode/opencode.json

@@ -16,6 +16,8 @@
       "permission": "allow"
     },
     "explore": {
+      "model": "{env:AGENTCI_EXPLORE_MODEL}",
+      "variant": "{env:AGENTCI_EXPLORE_VARIANT}",
       "permission": "allow"
     },
     "research": {
@@ -23,7 +25,12 @@
       "mode": "subagent",
       "model": "{env:AGENTCI_RESEARCH_MODEL}",
       "variant": "{env:AGENTCI_RESEARCH_VARIANT}",
-      "permission": "allow",
+      "permission": {
+        "*": "deny",
+        "websearch": "allow",
+        "context7_*": "allow",
+        "gh_grep_*": "allow"
+      },
       "prompt": "Research external, current, or unfamiliar technical facts for the parent agent. Use Context7 for library documentation, gh_grep for public-code examples, and web search for primary sources or broader verification. Prefer authoritative sources, report links, distinguish facts from inference, and return a concise evidence-focused summary. Do not include secrets or proprietary source in external queries."
     }
   },