feat(grok): price grok-build-0.1 + secret-scrub opencode plugin

- pricing.py: add grok-build-0.1 rates ($1/1M input, $0.20 cached, $2/1M
  output), verified against xAI's published pricing. Grok is a priced
  non-Anthropic model, so cost computes the moment usage is captured.
- secret-scrub.js: an opencode tool.execute.before plugin porting the
  security-critical bash-guard deny rules (git network ops, credential-file
  reads, /proc env, internal-host HTTP, roboco.* imports, ROBOCO_AGENT_ID
  forgery, env dumps, destructive rm) to the opencode runtime — restoring the
  guard the Claude Code hook can't provide there. Throwing denies the call
  (confirmed by opencode's env-protection example). Wired into the generated
  opencode.json plugin array + baked into the grok image.

Deny logic verified via node (9 deny + 5 allow cases). UNVALIDATED against a
live opencode runtime: confirm it fires in the live E2E spawn before a Grok
dev-agent touches a real repo; the bash permission is operator-tunable as a
second gate.

Cost CAPTURE (distinct from pricing) is intentionally NOT built yet: opencode's
plugin hooks expose model info but no token/usage object, so the capture path
is unconfirmed and needs the live spawn to settle.

docker/agent-grok.Dockerfile

@@ -20,6 +20,10 @@ RUN npm install -g opencode-ai @ai-sdk/openai-compatible \
     && npm cache clean --force \
     && rm -rf /root/.npm /tmp/*
 
+# Command guard / secret-scrub plugin (bash-guard parity for the opencode runtime).
+# Referenced from the generated opencode.json `plugin:` array.
+COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js
+
 # Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
 COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
 RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh