feat(providers): native Grok runtime — opencode image, config gen, panel key

Complete the native Grok (xAI) path so grok-build-0.1 runs as a real
RoboCo agent, not just the provider seam.

- roboco-agent-grok image (docker/agent-grok.Dockerfile): FROM agent-base
  + opencode (the OpenAI-protocol runtime). One image serves every role;
  role behaviour comes from the mounted manifest / mcp-config / system
  prompt, exactly as on the Claude path.
- Entrypoint renders opencode.json at spawn from the GrokProvider env
  contract + the mounted Claude Code mcp-config.json
  (roboco.llm.providers.opencode_config): translates RoboCo's gateway
  servers (roboco-flow / roboco-do / ...) into opencode's mcp block,
  declares the xAI OpenAI-compatible provider + model, and wires
  permissions + instructions. Pure, unit-tested translation.
- Orchestrator registers GrokProvider with the registry-qualified image
  (_qualify_agent_image) so it resolves in local and registry deploys.
- Compose (both files + the registry compose) gain an agent-grok-image
  builder service.
- Panel: a Grok (xAI) API key card on the AI Providers page, plus the
  grok ModelProvider value.

KNOWN PARITY GAP (opencode runtime): the bash-guard PAT-scrub and the
transcript-based usage/cost capture are Claude Code hooks and do not
transfer to opencode. bash permission is operator-tunable
(ROBOCO_GROK_BASH_PERMISSION) so a deployment can fail closed until a
security/usage-parity opencode plugin lands. That plugin and live E2E
validation are the remaining work to finalize with xAI.

docker/scripts/grok-agent-entrypoint.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Entrypoint for the roboco-agent-grok image.
+#
+# Renders opencode.json from the RoboCo spawn env (OPENAI_* + ROBOCO_*, set by
+# GrokProvider) plus the mounted Claude Code mcp-config.json, then runs opencode
+# non-interactively. opencode speaks the OpenAI protocol, so grok-build-0.1 runs
+# natively against api.x.ai/v1 with no shim, while still reaching the RoboCo MCP
+# gateway (roboco-flow / roboco-do / ...) translated into opencode's mcp config.
+set -euo pipefail
+
+# Generate opencode.json (provider + model + MCP gateway + permissions +
+# instructions). Writes to opencode's global config dir by default.
+python -m roboco.llm.providers.opencode_config
+
+# Run the agent. The prompt comes from an env var (never an untrusted argv
+# positional); `--` separates it from flags so a prompt starting with `--`
+# cannot be parsed as CLI options. The model also comes from the rendered
+# config; --model is passed explicitly as belt-and-suspenders.
+exec opencode run \
+  --model "xai/${ROBOCO_AGENT_MODEL:-grok-build-0.1}" \
+  -- "${ROBOCO_INITIAL_PROMPT:-}"