ci(gadfly): cloud-only fleet (3 models, drop local Macs)

Measured on the P2 review: the local Macs (m1/m5) took 26–29 min with lens
timeouts and found ZERO real bugs, while the two cloud models found every
genuine finding in 6–12 min. Drop the Macs; add glm-5.2:cloud as a third
cloud reviewer. Net: faster (~29→~12 min) and higher signal.

Models: minimax-m3:cloud, deepseek-v4-flash:cloud, glm-5.2:cloud
(ollama-cloud=3 concurrency). timeout-minutes 90→30.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.gitea/workflows/adversarial-review.yml

@@ -4,8 +4,8 @@
 # caches :latest, and this build is what carries foreman provider-type support)
 # as a specialist swarm and posts
 # ONE consolidated review comment as gitea-actions. Advisory only — never blocks a
-# merge. This reviews executus PRs (same setup as mort: m1/m5 foreman locals + 2
-# cloud, 3-lens suite). Gadfly is a simple system — findings are advisory; double-check.
+# merge. This reviews executus PRs with 3 ollama-cloud models (3-lens suite). Gadfly
+# is a simple system — findings are advisory; always double-check before acting.
 
 name: Adversarial Review (Gadfly)
 
@@ -41,35 +41,21 @@ jobs:
               || github.actor == 'fizi'
               || github.actor == 'dazed'))
     runs-on: ubuntu-latest
-    # Full fleet (2 cloud + 2 local Macs, all running concurrently) reviewing
-    # every PR with the 3-lens suite — the slow local lanes dominate wall time.
-    timeout-minutes: 90
+    # 3 cloud models, all concurrent, 3-lens suite. ~12 min typical.
+    timeout-minutes: 30
     steps:
       - uses: docker://gitea.stevedudenhoeffer.com/steve/gadfly:sha-6e3a83c
         env:
           GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           OLLAMA_CLOUD_API_KEY: ${{ secrets.OLLAMA_CLOUD_API_KEY }}
-          # Local Macs, reached through their foreman queues (native Ollama on the
-          # wire). Gadfly's GADFLY_ENDPOINT_* form with the "foreman" provider
-          # type: GADFLY_ENDPOINT_M1 registers provider "m1", _M5 registers "m5",
-          # each building a foreman-preset Ollama client at the given URL. Values
-          # (host + token) live in gitea secrets, each of the form:
-          #   foreman|https://<foreman-host>|<token>
-          # (converted from the komodo LLM_* DSNs foreman://<token>@<host>).
-          # REQUIRES a Gadfly image built with foreman provider-type support
-          # (the GADFLY_ENDPOINT "foreman|..." type); on an older image the m1/m5
-          # lanes error with "unknown provider foreman". The HTTPS-only LLM_*
-          # foreman:// DSN is the alternative that needs no image rebuild.
-          # NOTE: the Mac behind each foreman must still be awake/reachable; if a
-          # box is offline, that model's comment shows an error and the others
-          # still post. (Gitea secrets aren't auto-exposed — map each explicitly.)
-          GADFLY_ENDPOINT_M1: ${{ secrets.GADFLY_ENDPOINT_M1 }}
-          GADFLY_ENDPOINT_M5: ${{ secrets.GADFLY_ENDPOINT_M5 }}
-          # 2 cloud (parallel) + M1 Pro + M5 Max — one consolidated comment each.
-          GADFLY_MODELS: "minimax-m3:cloud,deepseek-v4-flash:cloud,m1/qwen3:14b,m5/qwen3.6:35b-mlx"
-          # cloud runs 2 at once; each Mac one at a time; all three lanes parallel.
-          GADFLY_PROVIDER_CONCURRENCY: "ollama-cloud=2,m1=1,m5=1"
+          # executus uses CLOUD MODELS ONLY. The local Macs (m1/m5) were dropped:
+          # on a P2-review measurement they took 26–29 min (with lens timeouts)
+          # and contributed ZERO real findings — the two cloud models found every
+          # genuine bug in 6–12 min. Cloud-only is faster AND higher-signal.
+          # 3 cloud models, one consolidated comment each, all run in parallel.
+          GADFLY_MODELS: "minimax-m3:cloud,deepseek-v4-flash:cloud,glm-5.2:cloud"
+          GADFLY_PROVIDER_CONCURRENCY: "ollama-cloud=3"
           # Default => the 3-lens suite (security, correctness, error-handling).
           # Set the repo var GADFLY_SPECIALISTS to override (csv / "all" / "auto").
           GADFLY_SPECIALISTS: ${{ vars.GADFLY_SPECIALISTS || 'security,correctness,error-handling' }}