fix(grok): harden cost-guard, pin runtime, refresh stale plugin comments

Address review findings on the Grok provider work:

- budget-feed plugin failed open unconditionally, so a one-shot task agent
  whose in-container SDK budget server went unreachable would run with the
  cost cap unenforced. The entrypoint now exports ROBOCO_BUDGET_ENFORCE=1
  (one-shot agents always start that server) and the plugin's pre-exec gate
  fails CLOSED when the flag is set and the budget endpoint is unreachable,
  halting an uncapped burn. Interactive serve agents (intake/secretary) set
  no flag and keep failing open (they run no budget server by design).

- Pin opencode-ai to the live-verified 1.17.8 (was an unpinned global npm
  install). Untrusted model output runs under it; bump the pin deliberately.

- Document the ROBOCO_GROK_* operator vars in .env.example (image, the three
  opencode permissions, reasoning effort, idle-kill, cost ceiling).

- Refresh stale plugin comments: the MCP tool-name shape and the secretary
  tool-registration path are confirmed live, and secret-scrub's load route is
  the auto-discovery dir (not a config plugin: array). Keep the honest
  not-yet-exercised caveat on secret-scrub's deny path and the reasoning
  variant — those remain genuinely unverified.

.env.example

@@ -83,6 +83,37 @@ ROBOCO_LOCAL_LLM_BASE_URL=http://localhost:11434/v1
 ROBOCO_LOCAL_LLM_MODEL=glm-5:cloud
 ROBOCO_DEFAULT_EMBEDDING_MODEL=qwen3-embedding:0.6b
 
+# =============================================================================
+# Grok (xAI) Provider — optional
+# =============================================================================
+# RoboCo can run agents on grok-build-0.1 (xAI) via the opencode runtime instead
+# of Claude Code. The xAI API key is NOT set here — store it encrypted per
+# project from the panel (provider key), the same as the Ollama/Anthropic keys.
+# Every var below is optional; defaults shown.
+
+# Image the orchestrator spawns for Grok agents.
+# ROBOCO_GROK_AGENT_IMAGE=roboco-agent-grok:latest
+
+# opencode tool permissions for Grok agents: allow | ask | deny. Defaults are
+# "allow"; tighten bash to "deny"/"ask" to fail closed on untrusted repos (the
+# secret-scrub plugin is a denylist, not a full sandbox).
+# ROBOCO_GROK_BASH_PERMISSION=allow
+# ROBOCO_GROK_EDIT_PERMISSION=allow
+# ROBOCO_GROK_EXTERNAL_DIR_PERMISSION=allow
+
+# Force one reasoning effort for ALL Grok agents: minimal | high | max (or empty
+# for opencode's default). Empty = per-role: coordination/docs roles request
+# "minimal" to cut reasoning cost, code roles keep full reasoning.
+# ROBOCO_GROK_REASONING_EFFORT=
+
+# Kill a Grok agent container after this many seconds idle (no model call /
+# stream) to reclaim a wedged one. Minimum 120.
+# ROBOCO_GROK_IDLE_KILL_SECONDS=900
+
+# Per-agent cost ceiling (USD) before the orchestrator kills the container;
+# 0 disables. Backstops runaway-loop token burn.
+# ROBOCO_GROK_MAX_COST_USD=0.0
+
 # =============================================================================
 # Security
 # =============================================================================