fix(grok): harden cost-guard, pin runtime, refresh stale plugin comments

Address review findings on the Grok provider work:

- budget-feed plugin failed open unconditionally, so a one-shot task agent
  whose in-container SDK budget server went unreachable would run with the
  cost cap unenforced. The entrypoint now exports ROBOCO_BUDGET_ENFORCE=1
  (one-shot agents always start that server) and the plugin's pre-exec gate
  fails CLOSED when the flag is set and the budget endpoint is unreachable,
  halting an uncapped burn. Interactive serve agents (intake/secretary) set
  no flag and keep failing open (they run no budget server by design).

- Pin opencode-ai to the live-verified 1.17.8 (was an unpinned global npm
  install). Untrusted model output runs under it; bump the pin deliberately.

- Document the ROBOCO_GROK_* operator vars in .env.example (image, the three
  opencode permissions, reasoning effort, idle-kill, cost ceiling).

- Refresh stale plugin comments: the MCP tool-name shape and the secretary
  tool-registration path are confirmed live, and secret-scrub's load route is
  the auto-discovery dir (not a config plugin: array). Keep the honest
  not-yet-exercised caveat on secret-scrub's deny path and the reasoning
  variant — those remain genuinely unverified.

docker/grok/secret-scrub.js

@@ -10,12 +10,13 @@
 // command is `output.args.command`; for `read`/`edit` the path is
 // `output.args.filePath`.
 //
-// Loaded via the generated opencode.json `plugin:` array (see
-// roboco.llm.providers.opencode_config). The agent's bash permission can also
-// be set to "deny"/"ask" via ROBOCO_GROK_BASH_PERMISSION as a second gate.
+// Baked into the plugin auto-discovery dir (~/.config/opencode/plugin/) at image
+// build (named export, opencode's convention) — the same route as budget-feed.
+// The agent's bash permission is a second gate via ROBOCO_GROK_BASH_PERMISSION.
 //
-// STATUS: unvalidated against a live opencode runtime. Confirm it actually
-// fires in the live E2E spawn before pointing a Grok dev-agent at a real repo.
+// STATUS: the plugin loads in the live runtime (same auto-discovery dir as the
+// live-confirmed budget-feed), but the deny-on-match path has not yet blocked a
+// real command on the NAS — confirm before trusting it as the sole bash gate.
 // Deny-on-match is fail-closed: a false positive blocks a legitimate command
 // (annoying, safe) rather than letting a dangerous one through.