ci: unbreak Bonk (switch to Workers AI)

.github/workflows/bonk.yml

@@ -47,13 +47,20 @@ jobs:
           CLOUDFLARE_GATEWAY_ID: ${{ secrets.CF_AI_GATEWAY_NAME }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CF_AI_GATEWAY_TOKEN }}
         with:
-          model: "cloudflare-ai-gateway/anthropic/claude-opus-4-8"
+          # Workers AI, not Anthropic: the gateway's upstream Anthropic key is
+          # invalid, so anthropic/* returns authentication_error regardless of
+          # the model id. k2.6 over the newer k2.7-code: the latter answers
+          # "LGTM!" without the summary the prompt asks for, on diffs of any size.
+          model: "cloudflare-ai-gateway/workers-ai/@cf/moonshotai/kimi-k2.6"
           mentions: "/bonk,@ask-bonk"
           # Only users with write access may invoke Bonk via comment.
           permissions: write
           # Review-only: Bonk leaves comments/suggestions but never pushes commits.
           token_permissions: NO_PUSH
-          opencode_version: 1.15.13 # pin to this version as certain ones cause ProviderInitError issues
+          # 1.15.13 reported nothing at all when the model call failed, which
+          # hid this breakage for three weeks. 1.17.7 is the version running
+          # green in cloudflare-docs.
+          opencode_version: "1.17.7"
           prompt: |
             Review this pull request. Summarize what it changes and flag any
             correctness, security, or style issues as inline review comments.

AGENTS.md

@@ -96,3 +96,19 @@ re-indent every workflow.
   4. On merge, the publish workflow auto-creates a git tag and publishes to npm.
 - **Do NOT** push directly to `main` — the branch ruleset blocks direct pushes.
   All changes must go through a pull request.
+
+## AI review (Bonk)
+
+`.github/workflows/bonk.yml` reviews PRs automatically on open, and on demand
+when someone with write access comments `/bonk`.
+
+Two things to know before editing that workflow:
+
+- It runs on **Workers AI**, not Anthropic. The AI Gateway's upstream Anthropic
+  key is invalid, so any `anthropic/*` model returns `authentication_error`
+  regardless of the model id.
+- **Comment-triggered runs execute the workflow from `main`,** because
+  `issue_comment` is a repository-level event. Changes to this file cannot be
+  tested with `/bonk` on a PR — only the `pull_request: [opened]` trigger uses
+  the branch copy, and it does not fire on pushes to an open PR. Verifying a
+  change means opening a fresh PR.