fix(grok): pre-create agent-owned ~/.local in the grok image (opencode state EACCES)

Running the built grok-prompter container surfaced a second EACCES the
mechanism analysis missed: bind-mounting the opencode store at
~/.local/share/opencode makes docker create the intermediate ~/.local AS ROOT,
so the non-root agent user then cannot create its sibling ~/.local/state and
opencode dies at boot. Pre-create the ~/.local tree agent-owned in the image so
the mount leaves the parents writable. Complements the orchestrator 0777
host-source pre-create (which covers the bind source on Linux).

Verified live: with this fix the container starts clean, opencode serve opens
the session, a POST /turn produces a real grok reply, and all chunks
(thinking/text/turn_end) reach the relay endpoint.

docker/agent-grok.Dockerfile

@@ -29,6 +29,15 @@ COPY docker/grok/secret-scrub.js /app/opencode-plugins/secret-scrub.js
 COPY docker/scripts/grok-agent-entrypoint.sh /app/scripts/grok-agent-entrypoint.sh
 RUN chmod 0755 /app/scripts/grok-agent-entrypoint.sh
 
+# opencode persists data under ~/.local/share and state under ~/.local/state.
+# When the orchestrator bind-mounts the opencode store at
+# ~/.local/share/opencode, docker creates the intermediate ~/.local AS ROOT, so
+# the non-root agent can no longer create its sibling ~/.local/state and opencode
+# EACCESes at boot. Pre-create the tree agent-owned so the mount leaves the
+# parents writable (complements the orchestrator's 0777 host-source pre-create).
+RUN mkdir -p /home/agent/.local/share/opencode /home/agent/.local/state \
+    && chown -R agent:agent /home/agent/.local
+
 USER agent
 
 LABEL role="grok-runtime"