GazSecOps

The chaos in env: is because OpenCode CLI supports multiple AI providers (OpenAI, Anthropic, Google, etc.). The workflow makes all of them available, but which one actually gets used depends on OPENCODE_CONFIG_CONTENT - it's a single provider choice, not all of them simultaneously.

Most of these secrets won't be defined in the repository - OpenCode will just use whatever's configured and skip the rest. It's overkill, yes, but it means the workflow doesn't break if someone switches providers.

Could be cleaner, but this is OpenChaos after all. 🤷‍♂️