bump claude-opus alias to 4-7

anthropic shipped claude-opus-4-7 today; opencode also republished it.
point the "claude-opus" alias at the new version for both providers so
existing users get the upgrade automatically. openrouter hasn't
published 4.7 yet, so leave openRouterResolve at 4.6 as the BYOR fallback.

also clarify the latest-model snapshot comment: new model drops usually
just mean bumping the `resolve` on an existing alias, not adding a new one.

Made-with: Cursor

main.ts

@@ -219,10 +219,7 @@ export async function main(): Promise<MainResult> {
 
   // configure env allowlist for subprocess filtering
   if (runContext.repoSettings.envAllowlist) {
-    const blocked = setEnvAllowlist(runContext.repoSettings.envAllowlist);
-    if (blocked.length > 0) {
-      log.warning(`env allowlist contains blocked names (ignored): ${blocked.join(", ")}`);
-    }
+    setEnvAllowlist(runContext.repoSettings.envAllowlist);
   }
 
   // resolve payload to determine shell permission