fix(grok): harden cost-guard, pin runtime, refresh stale plugin comments

Address review findings on the Grok provider work:

- budget-feed plugin failed open unconditionally, so a one-shot task agent
  whose in-container SDK budget server went unreachable would run with the
  cost cap unenforced. The entrypoint now exports ROBOCO_BUDGET_ENFORCE=1
  (one-shot agents always start that server) and the plugin's pre-exec gate
  fails CLOSED when the flag is set and the budget endpoint is unreachable,
  halting an uncapped burn. Interactive serve agents (intake/secretary) set
  no flag and keep failing open (they run no budget server by design).

- Pin opencode-ai to the live-verified 1.17.8 (was an unpinned global npm
  install). Untrusted model output runs under it; bump the pin deliberately.

- Document the ROBOCO_GROK_* operator vars in .env.example (image, the three
  opencode permissions, reasoning effort, idle-kill, cost ceiling).

- Refresh stale plugin comments: the MCP tool-name shape and the secretary
  tool-registration path are confirmed live, and secret-scrub's load route is
  the auto-discovery dir (not a config plugin: array). Keep the honest
  not-yet-exercised caveat on secret-scrub's deny path and the reasoning
  variant — those remain genuinely unverified.

docker/grok/secretary-tools.js

@@ -18,9 +18,9 @@
 // forwards the call. Each tool returns the backend JSON as a string the model
 // reads back (mirrors secretary_driver._text_result).
 //
-// UNVERIFIED-LIVE: the @opencode-ai/plugin tool-registration path against a live
-// opencode serve + grok-build-0.1 — confirm a submit_directive round-trips with
-// the HMAC token on the NAS before routing real CEO directives through Grok.
+// Verified live on the NAS: the @opencode-ai/plugin tool-registration path
+// round-trips against a live opencode serve + grok-build-0.1 — a directive
+// reaches the backend with the HMAC token and the JSON result returns to the model.
 
 import { tool } from "@opencode-ai/plugin";