fix: support OpenCode auth in read-only executor

deploy/compose.yaml

@@ -34,16 +34,8 @@ services:
       GITEA_WRITE_TOKEN_FILE: /run/secrets/gitea_write_token
       GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
     secrets:
-      - source: gitea_write_token
-        target: gitea_write_token
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
-      - source: gitea_webhook_secret
-        target: gitea_webhook_secret
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
+      - gitea_write_token
+      - gitea_webhook_secret
     networks:
       - gitea-common
     healthcheck:
@@ -54,6 +46,9 @@ services:
 
   executor:
     <<: *common
+    tmpfs:
+      - /tmp:rw,nosuid,nodev,mode=1777
+      - /var/lib/opencode-agent/state:rw,nosuid,nodev,noexec,mode=1777
     build:
       context: ..
       dockerfile: deploy/Dockerfile
@@ -63,19 +58,15 @@ services:
       <<: *common-environment
       GITEA_READ_TOKEN_FILE: /run/secrets/gitea_read_token
       XDG_DATA_HOME: /var/lib/opencode-agent/data
+      XDG_STATE_HOME: /var/lib/opencode-agent/state
       XDG_CACHE_HOME: /var/lib/opencode-agent/cache
     secrets:
-      - source: gitea_read_token
-        target: gitea_read_token
-        uid: "10001"
-        gid: "10001"
-        mode: 0400
+      - gitea_read_token
     volumes:
       - ${AGENT_STATE_DIR:-./state/server}:/var/lib/gitea-agent/state
       - ${AGENT_WORKSPACE_DIR:-./state/workspaces}:/var/lib/gitea-agent/workspaces
       - ${OPENCODE_DATA_DIR:-./state/opencode}:/var/lib/opencode-agent/data
       - ${CACHE_DIR:-./state/cache}:/var/lib/opencode-agent/cache
-      - ${OPENCODE_CONFIG_DIR:-./deploy/opencode-config}:/opt/ci-agents/empty-config/opencode
     depends_on:
       controller:
         condition: service_healthy