fix(agent-team): cut token spend — reduce cron frequency + downgrade team-lead to Sonnet (#3310)

Two high-impact, zero-risk changes to get daily agent team spend under $50:

1. Reduce cron frequency:
   - Security: */30 → every 4 hours (48→6 cycles/day, 87% reduction)
   - Refactor: */15 → every 2 hours (96→12 cycles/day, 87% reduction)

   Most cycles find nothing to do (no new PRs/issues). Issue-triggered runs
   (on labeled issues) still fire instantly via the `issues` event type,
   so response time to real work is unchanged. The trigger-server already
   returns 409 when a cycle is in-progress, so high cron frequency was just
   idle-polling cost.

2. Downgrade team-lead model from Opus to Sonnet:
   - Security: --model sonnet for review_all and scan modes (triage was
     already using gemini-3-flash-preview)
   - Refactor: --model sonnet

   The team lead's job is coordination — spawn teammates, monitor them,
   shut down. This is routing, not reasoning. Sonnet handles it fine and
   its output tokens are ~5x cheaper than Opus. Teammates (spawned by the
   lead) use their own model flags and are unaffected.

Combined effect: ~90% fewer cycles × ~80% cheaper per cycle on the team
lead = estimated 95%+ cost reduction on team-lead tokens alone.

Follow-up PR will trim prompt sizes (Phase 2) and consolidate security
teammates (Phase 3) per the plan, but this Phase 1 closes most of the gap.

Co-authored-by: L <6723574+louisgv@users.noreply.github.com>

.github/workflows/refactor.yml

@@ -2,7 +2,7 @@ name: Trigger Refactor
 
 on:
   schedule:
-    - cron: '*/15 * * * *'
+    - cron: '0 */2 * * *'
   issues:
     types: [opened, reopened, labeled]
   workflow_dispatch:

.github/workflows/security.yml

@@ -4,7 +4,7 @@ on:
   issues:
     types: [opened, reopened, labeled]
   schedule:
-    - cron: '*/30 * * * *'
+    - cron: '0 */4 * * *'
   workflow_dispatch:
 
 jobs: