chore(release): sync 9 qe-* agents from .claude/ to assets/ for v3.9.13

These agents were updated in .claude/agents/v3/ for ADR-093 but the
corresponding files in assets/agents/v3/ (the directory shipped to
users via aqe init) still carried stale advisor model IDs
(claude-opus-4, claude-opus-4-6). Fresh installs would have received
the old model references.

Synced files:
  qe-coverage-specialist, qe-fleet-commander, qe-pentest-validator,
  qe-queen-coordinator, qe-risk-assessor, qe-root-cause-analyzer,
  qe-security-auditor, qe-security-scanner, qe-test-architect

Verified in a fresh project: aqe init --auto now writes agent files
with claude-opus-4.7 / claude-opus-4-7 advisor models and the ADR-093
"effort: max" frontmatter for the three cyber-pinned agents.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

assets/agents/v3/qe-coverage-specialist.md

@@ -11,7 +11,7 @@ domain: coverage-analysis
 advisor:
   enabled: true
   provider: openrouter
-  model: anthropic/claude-opus-4
+  model: anthropic/claude-opus-4.7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-fleet-commander.md

@@ -8,7 +8,7 @@ domain: cross-domain
 advisor:
   enabled: true
   provider: openrouter
-  model: anthropic/claude-opus-4
+  model: anthropic/claude-opus-4.7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-pentest-validator.md

@@ -1,14 +1,16 @@
 ---
 name: qe-pentest-validator
 version: "3.6.0"
-updated: "2026-04-12"
+updated: "2026-04-17"
 description: Graduated exploit validation with parallel vulnerability pipelines, browser-based attack execution, and "No Exploit, No Report" quality gate
 v2_compat: null
 domain: security-compliance
+# ADR-093: security agents default to max effort for highest-stakes reasoning
+effort: max
 advisor:
   enabled: true
   provider: claude
-  model: claude-opus-4-6
+  model: claude-opus-4-7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-queen-coordinator.md

@@ -14,7 +14,7 @@ dependencies:
 advisor:
   enabled: true
   provider: openrouter
-  model: anthropic/claude-opus-4
+  model: anthropic/claude-opus-4.7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-risk-assessor.md

@@ -8,7 +8,7 @@ v3_new: true
 advisor:
   enabled: true
   provider: openrouter
-  model: anthropic/claude-opus-4
+  model: anthropic/claude-opus-4.7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-root-cause-analyzer.md

@@ -19,7 +19,7 @@ dependencies:
 advisor:
   enabled: true
   provider: openrouter
-  model: anthropic/claude-opus-4
+  model: anthropic/claude-opus-4.7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-security-auditor.md

@@ -1,14 +1,16 @@
 ---
 name: qe-security-auditor
 version: "3.0.0"
-updated: "2026-04-12"
+updated: "2026-04-17"
 description: Security audit specialist with OWASP coverage, compliance validation, and remediation workflows
 v2_compat: null # New in v3
 domain: security-compliance
+# ADR-093: security agents default to max effort for highest-stakes reasoning
+effort: max
 advisor:
   enabled: true
   provider: claude
-  model: claude-opus-4-6
+  model: claude-opus-4-7
   max_uses: 3
   redact: strict
 ---

assets/agents/v3/qe-security-scanner.md

@@ -1,10 +1,12 @@
 ---
 name: qe-security-scanner
 version: "3.0.0"
-updated: "2026-01-10"
+updated: "2026-04-17"
 description: Comprehensive security scanning with SAST, DAST, dependency scanning, and secrets detection
 v2_compat: qe-security-scanner
 domain: security-compliance
+# ADR-093: security agents default to max effort for highest-stakes reasoning
+effort: max
 dependencies:
   agents:
     - name: qe-dependency-mapper

assets/agents/v3/qe-test-architect.md

@@ -11,7 +11,7 @@ domain: test-generation
 advisor:
   enabled: true                    # ADR-092 Phase 0 target agent
   provider: openrouter             # Phase 0 default; any HybridRouter provider supported
-  model: anthropic/claude-opus-4   # Strong reasoning model via OpenRouter
+  model: anthropic/claude-opus-4.7   # Strong reasoning model via OpenRouter
   max_uses: 3                      # Per-task advisor call cap
   budget_usd_per_task: 0.05        # Per-call budget ceiling
   required: false                  # Phase 5 flips this to true for quality-gate enforcement