docs(0.7.0): document Grok provider, self-heal, PR-reviewer across the RAG + how-to docs

Close the doc gaps the audit found in the agent knowledge base and the human
walkthrough:
- config-reference: add the Grok provider env table (host ~/.grok subscription
  mount, grok-build, idle-kill, cost cap) and the Self-Healing CI loop toggles.
- agent-model: provider-aware Model Configuration (ANTHROPIC default / GROK) +
  add the pr_reviewer / prompter / secretary roles to the Roles table.
- tool-permissions: 'three' -> five MCP servers (roboco-optimal, roboco-docs) +
  PR Reviewer / Prompter / Secretary tool sections.
- new roles/pr-reviewer.md (the 22nd agent had no role doc); permissions +
  agent-uuids + task-tools 'PR Reviewer flow' all gain the role.
- api-endpoints: drop the removed USAGE_UPDATE event (only USAGE_SNAPSHOT exists).
- how-to: self-healing CI loop + Company Scorecard (ch.5), inbound external-PR
  review + CEO Supersede/Dismiss queue (ch.4).

Every claim verified against current code by the audit (grok model grok-build,
auth ~/.grok, no metered API; opencode fully removed).

docs/rag/architecture/tool-permissions.md

@@ -2,13 +2,15 @@
 
 ## Overview
 
-Agents call gateway verbs through three MCP servers, scoped per role:
+Agents call gateway verbs through up to five MCP servers, scoped per role:
 
 | MCP server | Provides |
 |------------|----------|
 | `roboco-flow` | Lifecycle verbs (give_me_work, i_will_work_on, open_pr, complete, …) |
 | `roboco-do` | Content/write verbs (commit, note, say, dm, notify, evidence) |
 | `roboco-git-readonly` | Read-only git inspection (status, log, diff, branch_list) |
+| `roboco-optimal` | RAG (`roboco_ask_mentor`, `roboco_kb_search`) |
+| `roboco-docs` | Project docs file management (selected roles) |
 
 Native shell git is blocked by the bash-guard hook for everyone. There is **no** `roboco_git_commit / _push / _create_pr / _merge_pr / _checkout` tool — write operations happen through the lifecycle verbs and the choreographer handles git as a side-effect.
 
@@ -80,6 +82,26 @@ The canonical source of role → verb mapping is `roboco/services/gateway/role_c
 
 **Read-only git:** none.
 
+## PR Reviewer
+
+**Flow verbs:** `give_me_work`, `claim_pr_review`, `post_pr_review`, `i_am_idle`  (read-only)
+
+**Content verbs:** `note`, `evidence`, plus notification reads (`notify_list`, `notify_get`) and channel discovery — no `say` / `dm`: the change-request is posted server-side on the PR itself.
+
+**Read-only git:** none.
+
+**Workspace writes:** none — reviews inbound external/fork + internal PRs only.
+
+## Prompter (Intake) & Secretary
+
+Both are human-only roles — they chat with the CEO, not other agents.
+
+**Flow verbs:** `i_am_idle` only.
+
+**Content verbs:** `note`, `evidence` only (no `say` / `dm` / `notify`).
+
+**Read-only git / workspace writes:** none.
+
 ## Tool Permissions Summary
 
 | Capability | Dev | Doc | QA | Cell PM | Main PM | Board | Auditor |