fix(agent-team): cut token spend — reduce cron frequency + downgrade team-lead to Sonnet (#3310)

Two high-impact, zero-risk changes to get daily agent team spend under $50:

1. Reduce cron frequency:
   - Security: */30 → every 4 hours (48→6 cycles/day, 87% reduction)
   - Refactor: */15 → every 2 hours (96→12 cycles/day, 87% reduction)

   Most cycles find nothing to do (no new PRs/issues). Issue-triggered runs
   (on labeled issues) still fire instantly via the `issues` event type,
   so response time to real work is unchanged. The trigger-server already
   returns 409 when a cycle is in-progress, so high cron frequency was just
   idle-polling cost.

2. Downgrade team-lead model from Opus to Sonnet:
   - Security: --model sonnet for review_all and scan modes (triage was
     already using gemini-3-flash-preview)
   - Refactor: --model sonnet

   The team lead's job is coordination — spawn teammates, monitor them,
   shut down. This is routing, not reasoning. Sonnet handles it fine and
   its output tokens are ~5x cheaper than Opus. Teammates (spawned by the
   lead) use their own model flags and are unaffected.

Combined effect: ~90% fewer cycles × ~80% cheaper per cycle on the team
lead = estimated 95%+ cost reduction on team-lead tokens alone.

Follow-up PR will trim prompt sizes (Phase 2) and consolidate security
teammates (Phase 3) per the plan, but this Phase 1 closes most of the gap.

Co-authored-by: L <6723574+louisgv@users.noreply.github.com>

.claude/skills/setup-agent-team/refactor.sh

@@ -221,7 +221,9 @@ log "Hard timeout: ${HARD_TIMEOUT}s"
 
 # Run claude in background, output goes to log file.
 # The trigger server is fire-and-forget — VM keep-alive is handled by systemd.
-claude -p "$(cat "${PROMPT_FILE}")" >> "${LOG_FILE}" 2>&1 &
+# Team lead uses Sonnet — coordination (spawn, monitor, shutdown) doesn't need
+# Opus-level reasoning and Sonnet output tokens are 5x cheaper.
+claude -p "$(cat "${PROMPT_FILE}")" --model sonnet >> "${LOG_FILE}" 2>&1 &
 CLAUDE_PID=$!
 log "Claude started (pid=${CLAUDE_PID})"
 

.claude/skills/setup-agent-team/security.sh

@@ -320,8 +320,12 @@ HARD_TIMEOUT=$((CYCLE_TIMEOUT + 300))
 log "Hard timeout: ${HARD_TIMEOUT}s"
 
 # Run claude in background, output goes to log file.
-# Triage uses gemini-3-flash (lightweight safety check); other modes use default (Opus) for team lead.
-CLAUDE_MODEL_FLAG=""
+# Triage uses gemini-3-flash (lightweight safety check).
+# All other modes use Sonnet for the team lead — the lead's job is coordination
+# (spawn teammates, monitor, shut down), not deep reasoning. Opus is 5x more
+# expensive on output tokens and the quality difference for coordination is
+# negligible. Teammates (spawned by the lead) use their own model flags.
+CLAUDE_MODEL_FLAG="--model sonnet"
 if [[ "${RUN_MODE}" == "triage" ]]; then
     CLAUDE_MODEL_FLAG="--model google/gemini-3-flash-preview"
 fi

.github/workflows/refactor.yml

@@ -2,7 +2,7 @@ name: Trigger Refactor
 
 on:
   schedule:
-    - cron: '*/15 * * * *'
+    - cron: '0 */2 * * *'
   issues:
     types: [opened, reopened, labeled]
   workflow_dispatch:

.github/workflows/security.yml

@@ -4,7 +4,7 @@ on:
   issues:
     types: [opened, reopened, labeled]
   schedule:
-    - cron: '*/30 * * * *'
+    - cron: '0 */4 * * *'
   workflow_dispatch:
 
 jobs: