docs(grok): document Grok's reduced guardrail posture (honest, not blocking)

Grok agents run on opencode, not Claude Code, so they do NOT have full
guardrail parity — claiming otherwise would be false. Document it truthfully
and keep them usable rather than blocking them.

- Panel routing card: an amber caveat shown in Grok/Mix mode — command/
  secret-exfil guard + cost cap apply to Grok, but the prompt-injection guard
  does NOT (opencode cannot block a turn); Anthropic/Ollama/Self-Hosted run
  through Claude Code with the full guard set; prefer those for agents that
  ingest untrusted or cross-agent content; Grok is safe for trusted work.
- docs/self/architecture/llm-provider-security.md: the reference — the two
  runtimes, which provider uses which, the per-guardrail parity matrix, why
  the injection/stop gaps exist (opencode hooks are observe-only), and the
  routing recommendation (delivery roles handling untrusted content → a
  Claude-Code-runtime provider).

Panel tsc + eslint clean.

panel/src/components/settings/ai-routing-card.tsx

@@ -491,6 +491,20 @@ export function AIRoutingCard() {
               saved — those agents will fall back to Anthropic at spawn.
             </p>
           ) : null}
+          {currentMode === "grok" || currentMode === "mix" ? (
+            <p className="text-xs text-amber-600 flex items-start gap-1">
+              <AlertTriangle className="h-3 w-3 shrink-0 mt-0.5" />
+              <span>
+                Grok agents run on the opencode runtime, not Claude Code: the
+                command / secret-exfiltration guard and the cost cap apply, but
+                the prompt-injection guard does not (opencode cannot block a
+                turn before the model reads it). Anthropic, Ollama and
+                Self-Hosted all run through Claude Code with the full guard set
+                — prefer them for agents that ingest untrusted or cross-agent
+                content. Grok is safe for trusted work.
+              </span>
+            </p>
+          ) : null}
         </section>
 
         {/* -------- Self-Hosted model picker (when self_hosted mode active) -------- */}