feat: add claude-code/opus reviewer + max-thinking spec support (#5)

Adds claude-code/opus to gadfly's dogfood swarm (both sonnet and opus run
end-to-end), bumps the image pin to :sha-80d8f53 so the clean-lens
telemetry fix is live, and adds engine support for a
"claude-code/<model>:max" extended-thinking spec (MAX_THINKING_TOKENS,
best-effort). Validated: only 13 findings on this clean PR vs 43 on the
comparable #4 — the telemetry fix works.

Folded in the swarm's two real findings: a runPass env-injection test and
keeping MAX_THINKING_TOKENS in claudeEnv. Follow-up enables
claude-code/opus:max once this image builds.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>
Co-committed-by: Steve Dudenhoeffer <steve@stevedudenhoeffer.com>

README.md

@@ -89,12 +89,18 @@ parses the result and runs the same verdict-parse → recheck → consolidate
 CLI is bundled in the image (Node + `@anthropic-ai/claude-code`).
 
 Select it as a model id — bare `claude-code` (CLI default model) or `claude-code/<model>` (the
-suffix becomes `--model`, e.g. `claude-code/sonnet`, `claude-code/opus`):
+suffix becomes `--model`, e.g. `claude-code/sonnet`, `claude-code/opus`). An optional
+`:<thinking>` suffix forces an extended-thinking budget for that reviewer — `:max` (the high
+"ultrathink" tier) or `:<n>` for a specific token budget — so you can run the same model at two
+thinking depths as separate reviewers:
 
 ```yaml
-GADFLY_MODELS: "claude-code/sonnet,claude-code/opus"
+GADFLY_MODELS: "claude-code/sonnet,claude-code/opus,claude-code/opus:max"
 ```
 
+The thinking budget is applied via the `MAX_THINKING_TOKENS` env on the CLI subprocess; it's
+best-effort (a no-op if the installed CLI build doesn't honor it).
+
 Auth is read from the environment: the default is a **Pro/Max subscription** via
 `CLAUDE_CODE_OAUTH_TOKEN` (from `claude setup-token`; no `--bare`), falling back to
 `ANTHROPIC_API_KEY`. Don't set both. Tuning knobs (all optional):