chore: switch scan model to kimi-k2.5-free and update deploy docs

- Use opencode/kimi-k2.5-free for initial threat scanning (free tier)
- Verification still uses AWS Bedrock Opus for accuracy
- Update DEPLOY.md to use AWS_BEARER_TOKEN_BEDROCK instead of ANTHROPIC_API_KEY

Author: homanp

crates/worker/src/scanner/agentic.rs

@@ -12,8 +12,8 @@ use tokio::process::Command;
 /// Timeout for OpenCode commands (5 minutes)
 const OPENCODE_TIMEOUT_SECS: u64 = 300;
 
-/// Model used for initial threat scanning (AWS Bedrock - Sonnet)
-const SCAN_MODEL: &str = "amazon-bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0";
+/// Model used for initial threat scanning (Kimi K2.5 - free tier)
+const SCAN_MODEL: &str = "opencode/kimi-k2.5-free";
 
 /// Model used for threat verification (AWS Bedrock - Opus for accuracy)
 const VERIFICATION_MODEL: &str = "amazon-bedrock/us.anthropic.claude-opus-4-5-20251101-v1:0";
@@ -950,11 +950,8 @@ mod tests {
 
     #[test]
     fn test_model_constants() {
-        // Verify model constants are defined correctly (AWS Bedrock)
-        assert_eq!(
-            SCAN_MODEL,
-            "amazon-bedrock/us.anthropic.claude-sonnet-4-5-20250929-v1:0"
-        );
+        // Verify model constants are defined correctly
+        assert_eq!(SCAN_MODEL, "opencode/kimi-k2.5-free");
         assert_eq!(
             VERIFICATION_MODEL,
             "amazon-bedrock/us.anthropic.claude-opus-4-5-20251101-v1:0"

deploy.md

@@ -40,7 +40,7 @@ gcloud run deploy sus-worker \
   --platform managed \
   --allow-unauthenticated \
   --min-instances 1 \
-  --set-env-vars "DATABASE_URL=$DATABASE_URL,REDIS_URL=$REDIS_URL,ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY,GITHUB_TOKEN=$GITHUB_TOKEN,RUST_LOG=info"
+  --set-env-vars "DATABASE_URL=$DATABASE_URL,REDIS_URL=$REDIS_URL,AWS_BEARER_TOKEN_BEDROCK=$AWS_BEARER_TOKEN_BEDROCK,AWS_REGION=$AWS_REGION,GITHUB_TOKEN=$GITHUB_TOKEN,RUST_LOG=info"
 ```
 
 ### API (serves package data)