feat(grok): give the Grok Intake its propose_draft tool (draft card)

The prompter prompt tells the model to call propose_draft when the spec is
ready, but on Grok that tool didn't exist — so no draft chunk, no panel draft
card, and the human couldn't launch a task from a Grok intake chat.

- intake-tools.js: opencode plugin registering propose_draft via Hooks.tool;
  the execute() only ACKs — the driver (OpencodeServeSession.normalize ->
  _is_propose_draft -> _draft_from_tool_input) intercepts the tool CALL and
  emits the `draft` chunk the panel renders.
- agent-grok-prompter.Dockerfile: bake the plugin, scoped to this image via
  ROBOCO_OPENCODE_EXTRA_PLUGINS (delivery roles never draft).
- test: a propose_draft tool part normalizes to a draft chunk (not a tool_use).

The live tool-call -> draft-card path is flagged UNVERIFIED-LIVE for the NAS.

tests/unit/agent_sdk/test_opencode_session.py

@@ -51,6 +51,27 @@ def test_fenced_draft_in_text_becomes_draft_chunk() -> None:
     assert draft.data["title"] == "Add login"
 
 
+def test_propose_draft_tool_part_becomes_draft_chunk() -> None:
+    # The intake-tools.js propose_draft tool call (its input nested under
+    # `draft`) is intercepted into a draft chunk — NOT rendered as a tool_use —
+    # so the panel shows the draft card. This is the primary Grok-intake path.
+    chunks = normalize_opencode_message(
+        {
+            "parts": [
+                {
+                    "type": "tool",
+                    "tool": "propose_draft",
+                    "input": {"draft": {"title": "Add login", "team": "backend"}},
+                }
+            ]
+        }
+    )
+    assert "tool_use" not in _kinds(chunks)
+    draft = next(c for c in chunks if c.kind == "draft")
+    assert draft.data["title"] == "Add login"
+    assert draft.data["team"] == "backend"
+
+
 def test_unknown_part_skipped_but_turn_still_ends() -> None:
     chunks = normalize_opencode_message({"parts": [{"type": "mystery", "x": 1}]})
     assert _kinds(chunks) == ["turn_end"]