feat(kimi): Kimi K3 provider on the official kimi-code CLI (#713)

* feat(kimi): Kimi K3 provider on the official kimi-code CLI (Wave 1)

ModelProvider.KIMI routes through KimiCliProvider driving Moonshot's kimi
CLI on a Kimi subscription (OAuth device-code, no metered key). One-shot
delivery roles only (V1), interactive ban wired in both guard lists.

Auth: one shared RW auth mount; containers symlink credentials/ and
oauth/ (the CLI's cross-process refresh-lock dir) into a container-local
KIMI_CODE_HOME so every container and the host redeem the SAME rotating
refresh chain - live-verified that per-copy chains cross-invalidate after
the reuse-grace window. No orchestrator refresh daemon; an expires_at
preflight exits 78.

Config renderer mirrors the login-managed provider/model blocks
field-for-field (live-captured; the model value is the CLI-side name,
never the raw API id), plus per-role deny rules and the bash-guard as a
PreToolUse hook via a wrapper script (an env key on a hooks entry makes
the CLI silently drop ALL hooks - live-verified). Usage capture sums
wire.jsonl usage.record 4-bucket events; sniff classifies rate-limit/auth
from structured error text only, mapped to the shared 75/78 park
contract. Image installs the CLI latest-at-build (no version pin, by
policy) with the resolved version stamped as provenance, binary split to
/usr/local away from mutable state.

Migrations 090 (enum) + 091 (provider seed); catalog, pricing, routing
mode, and orchestrator park/usage wiring mirror the codex integration.

* feat(kimi): surface sweep + fleet-wide pin drop (Wave 2)

Compose x3 gain the agent-kimi-image service and the orchestrator's
read-write ~/.kimi-code mount + kimi-usage dir; .env.example documents
the Kimi block. Panel mirrors ModelProvider.KIMI and adds the kimi
routing mode (catalog filter, mode button, mix-picker group, badge) with
tests; provider routes gain the kimi remediation entry. CLAUDE.md and
docs/map document the runtime. Per the no-pins policy, agent-grok/
gemini/codex Dockerfiles drop their version pins for latest-at-build
with resolved-version provenance stamps (grok resolves 0.2.112 vs the
old 0.2.56 pin - verified by real builds of all four images).

---------

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

docker/agent-grok.Dockerfile

@@ -17,17 +17,21 @@ USER root
 # Install the official grok CLI (Grok Build) for the agent user. The installer's
 # default is $HOME/.grok/bin, so the binary lands at ~/.grok/bin/grok alongside
 # its runtime (downloads / bundled / skills) under ~/.grok, all agent-owned.
-# Pinned — untrusted model output runs under it, so bump the version deliberately,
-# never float. Download the installer to a file first (a `curl | bash` pipe hides
-# a curl failure as a silent no-op) and verify the binary installed AND runs, so
-# a broken install fails the build here, not at spawn. (curl/bash from the base.)
-ARG GROK_CLI_VERSION=0.2.56
+# NO version pin (2026-07-28 policy: latest-at-build, always adapt — fleet-wide
+# across grok/gemini/codex/kimi). Download the installer to a file first (a
+# `curl | bash` pipe hides a curl failure as a silent no-op) and verify the
+# binary installed AND runs, so a broken install fails the build here, not at
+# spawn; the resolved version is stamped to /etc/grok-cli-version (build-log +
+# on-disk provenance, not a pin — the next build reinstalls whatever's latest).
 RUN su agent -s /bin/bash -c "set -euo pipefail; export HOME=/home/agent; \
       curl -fsSL https://x.ai/cli/install.sh -o /tmp/grok-install.sh; \
-      bash /tmp/grok-install.sh ${GROK_CLI_VERSION}; \
-      test -x /home/agent/.grok/bin/grok; \
-      /home/agent/.grok/bin/grok --version" \
-    && rm -rf /tmp/*
+      bash /tmp/grok-install.sh; \
+      test -x /home/agent/.grok/bin/grok" \
+    && rm -rf /tmp/* \
+    # Provenance stamp runs as root (outside the su subshell — /etc is
+    # root-writable only) with root's HOME; fine while `grok --version`
+    # touches no $HOME-relative state.
+    && /home/agent/.grok/bin/grok --version | tee /etc/grok-cli-version
 
 # Entrypoint: render ~/.grok/config.toml + the per-role flags, then run grok
 # headless (overrides the base image's `claude` entrypoint). ~/.grok is already
@@ -43,5 +47,6 @@ ENV PATH="/home/agent/.grok/bin:/app/.venv/bin:$PATH"
 
 LABEL role="grok-cli-runtime"
 LABEL description="Grok (xAI) agent runtime — Grok Build via the official grok CLI"
+LABEL grok.cli.pinned="false"
 
 ENTRYPOINT ["/app/scripts/grok-cli-agent-entrypoint.sh"]