fix(ui): shorten the OpenCode notice to what OpenCode said, live from 17 October

The message ran 66 words over five sentences, which pushed the update
toast's buttons off a 360x640 phone. It also repeated the card's own
eyebrow ("Security notice for OpenCode users:"), placed the breached
"legacy system" inside the Console (no source says so), and closed with
an unsourced line about the CLI not being affected. The new text (55
words) says what OpenCode said, including its own reassurance that a
user who got no email was not affected, which matters because the card
goes to every opencode user while about 1.4% of Console users were hit.
The zh-CN text follows it and uses 撤销 for revoking keys.

published moves to 2026-10-17, so the notice is already live in every
timezone when the release lands: a browser still on the 17th would
otherwise take the plain update toast and get the notice later as a
separate card. docs/releasing.md says both things for the next notice.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/web/public/security-notices.json

@@ -4,15 +4,15 @@
       "id": "opencode-console-breach-2026-10",
       "severity": "warning",
       "cli": "opencode",
-      "published": "2026-10-18",
+      "published": "2026-10-17",
       "expires": "2026-12-31",
       "title": "OpenCode Console breach: check your API keys",
-      "message": "Security notice for OpenCode users: on 17 October OpenCode reported unauthorized access to a legacy OpenCode Console system. Provider API keys some users had saved in a Console workspace (OpenAI, Anthropic and others) may have been exposed. OpenCode emailed the affected users: if you got that email, revoke and replace those keys and check their recent usage. The opencode CLI itself is not reported as affected.",
+      "message": "OpenCode reported unauthorized access to a legacy system on 17 October. Provider API keys (OpenAI, Anthropic and others) saved in some OpenCode Console workspaces may have been exposed. If OpenCode emailed you about it, revoke and replace those keys and check their recent usage. If you got no email, OpenCode says you were not affected.",
       "link": { "label": "Read OpenCode's notice", "url": "https://x.com/opencode/status/2111519637049319818" },
       "i18n": {
         "zh-CN": {
           "title": "OpenCode Console 遭入侵：请检查你的 API 密钥",
-          "message": "OpenCode 用户安全提示：OpenCode 于 10 月 17 日报告，其旧版 OpenCode Console 系统遭到未授权访问。部分用户保存在 Console 工作区中的提供商 API 密钥（OpenAI、Anthropic 等）可能已泄露。OpenCode 已向受影响的用户发送邮件：如果你收到了该邮件，请吊销并更换这些密钥，并检查近期用量。目前没有报告称 opencode CLI 本身受到影响。",
+          "message": "OpenCode 于 10 月 17 日报告，其一个旧系统遭到未授权访问，部分用户保存在 OpenCode Console 工作区中的提供商 API 密钥（OpenAI、Anthropic 等）可能已泄露。如果你收到了 OpenCode 的相关邮件，请撤销并更换这些密钥，同时检查近期用量。OpenCode 表示，没有收到邮件的用户不受影响。",
           "label": "查看 OpenCode 公告"
         }
       }