docs(grok): drop the security disclaimers — injection guard closes the gap

With the prompt-injection guard now recreated for Grok (prior commit), the
"Grok lacks the injection guard / prefer Claude for delivery roles" warning is
no longer true, so remove it:

- Panel routing card: replace the amber "prefer Claude / not safe" caveat with
  a neutral one-liner — Grok agents run on opencode; the command/secret-exfil
  guard, the prompt-injection guard, and the cost cap all apply.
- docs/self/architecture/llm-provider-security.md: prompt-injection row flips to
  "yes" for Grok; intro + routing recommendation updated to "effective security
  parity, any agent (incl. delivery roles) can run on Grok"; the only remaining
  unported hook is the non-security stop-guard.
- opencode_config docstring: the remaining gap is now just the stop-guard
  (budget + injection are covered).

Panel tsc + eslint clean.

panel/src/components/settings/ai-routing-card.tsx

@@ -492,17 +492,10 @@ export function AIRoutingCard() {
             </p>
           ) : null}
           {currentMode === "grok" || currentMode === "mix" ? (
-            <p className="text-xs text-amber-600 flex items-start gap-1">
-              <AlertTriangle className="h-3 w-3 shrink-0 mt-0.5" />
-              <span>
-                Grok agents run on the opencode runtime, not Claude Code: the
-                command / secret-exfiltration guard and the cost cap apply, but
-                the prompt-injection guard does not (opencode cannot block a
-                turn before the model reads it). Anthropic, Ollama and
-                Self-Hosted all run through Claude Code with the full guard set
-                — prefer them for agents that ingest untrusted or cross-agent
-                content. Grok is safe for trusted work.
-              </span>
+            <p className="text-xs text-muted-foreground">
+              Grok agents run on the opencode runtime; the command /
+              secret-exfiltration guard, the prompt-injection guard, and the
+              per-agent cost cap all apply.
             </p>
           ) : null}
         </section>