feat(providers): native Grok runtime — opencode image, config gen, panel key

Complete the native Grok (xAI) path so grok-build-0.1 runs as a real
RoboCo agent, not just the provider seam.

- roboco-agent-grok image (docker/agent-grok.Dockerfile): FROM agent-base
  + opencode (the OpenAI-protocol runtime). One image serves every role;
  role behaviour comes from the mounted manifest / mcp-config / system
  prompt, exactly as on the Claude path.
- Entrypoint renders opencode.json at spawn from the GrokProvider env
  contract + the mounted Claude Code mcp-config.json
  (roboco.llm.providers.opencode_config): translates RoboCo's gateway
  servers (roboco-flow / roboco-do / ...) into opencode's mcp block,
  declares the xAI OpenAI-compatible provider + model, and wires
  permissions + instructions. Pure, unit-tested translation.
- Orchestrator registers GrokProvider with the registry-qualified image
  (_qualify_agent_image) so it resolves in local and registry deploys.
- Compose (both files + the registry compose) gain an agent-grok-image
  builder service.
- Panel: a Grok (xAI) API key card on the AI Providers page, plus the
  grok ModelProvider value.

KNOWN PARITY GAP (opencode runtime): the bash-guard PAT-scrub and the
transcript-based usage/cost capture are Claude Code hooks and do not
transfer to opencode. bash permission is operator-tunable
(ROBOCO_GROK_BASH_PERMISSION) so a deployment can fail closed until a
security/usage-parity opencode plugin lands. That plugin and live E2E
validation are the remaining work to finalize with xAI.

docker/agent-grok.Dockerfile

@@ -0,0 +1,32 @@
+# Grok (xAI) Agent Image
+# =============================================================================
+# Runs grok-build-0.1 through the opencode CLI (OpenAI protocol) instead of
+# Claude Code, while reusing the base image's roboco venv + uv + the RoboCo MCP
+# gateway servers. The entrypoint renders opencode.json from the spawn env +
+# mounted mcp-config.json (see roboco.llm.providers.opencode_config) and runs
+# opencode. One runtime image serves every role — role behaviour comes from the
+# mounted system prompt / manifest / mcp-config, exactly as on the Claude path.
+# =============================================================================
+
+FROM roboco-agent-base
+
+USER root
+
+# opencode — the OpenAI-protocol agent runtime. The @ai-sdk/openai-compatible
+# package backs the custom xAI provider declared in the generated opencode.json;
+# opencode also resolves it at runtime, but pre-installing keeps first spawn off
+# the network.
+RUN npm install -g opencode-ai @ai-sdk/openai-compatible \
+    && npm cache clean --force \
+    && rm -rf /root/.npm /tmp/*
+
+# Entrypoint: render opencode.json, then run opencode (overrides base's `claude`).
+COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
+RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
+
+USER agent
+
+LABEL role="grok-runtime"
+LABEL description="Grok (xAI) agent runtime — grok-build-0.1 via opencode (OpenAI protocol)"
+
+ENTRYPOINT ["/app/scripts/grok-agent-entrypoint.sh"]

docker/scripts/grok-agent-entrypoint.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Entrypoint for the roboco-agent-grok image.
+#
+# Renders opencode.json from the RoboCo spawn env (OPENAI_* + ROBOCO_*, set by
+# GrokProvider) plus the mounted Claude Code mcp-config.json, then runs opencode
+# non-interactively. opencode speaks the OpenAI protocol, so grok-build-0.1 runs
+# natively against api.x.ai/v1 with no shim, while still reaching the RoboCo MCP
+# gateway (roboco-flow / roboco-do / ...) translated into opencode's mcp config.
+set -euo pipefail
+
+# Generate opencode.json (provider + model + MCP gateway + permissions +
+# instructions). Writes to opencode's global config dir by default.
+python -m roboco.llm.providers.opencode_config
+
+# Run the agent. The prompt comes from an env var (never an untrusted argv
+# positional); `--` separates it from flags so a prompt starting with `--`
+# cannot be parsed as CLI options. The model also comes from the rendered
+# config; --model is passed explicitly as belt-and-suspenders.
+exec opencode run \
+  --model "xai/${ROBOCO_AGENT_MODEL:-grok-build-0.1}" \
+  -- "${ROBOCO_INITIAL_PROMPT:-}"