feat(grok): scope opencode edit/bash/external-dir permissions per role

Grok wrote ONE global permission block, so a Grok pr_reviewer (or qa / PM /
auditor) ran with edit=allow + bash=allow on untrusted PR content. Now the
permissions are derived per role, mirroring orchestrator._get_role_permissions
on the Claude path:

- edit  — allow only roles that write code (role_config.allows_write:
  developer / documenter); everyone else edit=deny.
- bash  — allow only roles that legitimately run a shell (developer /
  documenter / cell_pm / main_pm); the read-only reviewers (qa / pr_reviewer /
  auditor) and the board get bash=deny. secret-scrub still guards the rest.
- external_directory — only the pr_reviewer reads scratch outside its cwd (the
  /tmp diff); delivery roles get deny.

One-shot roles resolve these in GrokProvider._append_grok_env; the interactive
intake/secretary set edit=deny + bash=deny in the orchestrator (intake keeps
external-dir reads for sibling product repos, the secretary does not). The
Claude path is untouched — the permission env is a GROK-only contract.

Targeted gate green (ruff/mypy/xenon + provider + interactive-spawn tests).

tests/unit/runtime/test_interactive_grok_spawn.py

@@ -67,6 +67,21 @@ def test_intake_grok_uses_openai_env_and_opencode_mount() -> None:
     assert cmd[-1] == GROK_PROMPTER_IMAGE
     # The xAI endpoint is never mislabelled as Anthropic.
     assert not any(c.startswith("ANTHROPIC_") for c in cmd)
+    # Intake is read-only (no code edits, no shell) but reads sibling product
+    # repos OUTSIDE its cwd, so it keeps external-directory reads.
+    assert "ROBOCO_GROK_EDIT_PERMISSION=deny" in cmd
+    assert "ROBOCO_GROK_BASH_PERMISSION=deny" in cmd
+    assert "ROBOCO_GROK_EXTERNAL_DIR_PERMISSION=allow" in cmd
+
+
+def test_intake_anthropic_omits_grok_permission_env() -> None:
+    # The opencode permission env is a GROK-only contract; the Claude path never
+    # sets it (it gates tools via the SDK can_use_tool allowlist instead).
+    cmd = AgentOrchestrator._build_intake_run_cmd(
+        _intake_spec("anthropic", base_url="https://api.anthropic.com", token="sk-ant")
+    )
+    assert not any(c.startswith("ROBOCO_GROK_EDIT_PERMISSION=") for c in cmd)
+    assert not any(c.startswith("ROBOCO_GROK_BASH_PERMISSION=") for c in cmd)
 
 
 def test_intake_grok_omits_variant_when_unset() -> None:
@@ -109,3 +124,8 @@ def test_secretary_grok_uses_openai_env_and_grok_image() -> None:
     assert "ROBOCO_AGENT_TOKEN=hmac-secretary" in cmd
     assert cmd[-1] == GROK_SECRETARY_IMAGE
     assert not any(c.startswith("ANTHROPIC_") for c in cmd)
+    # The Secretary is read-only and reads only /app + the API, so edit/bash
+    # are denied and it gets NO external-directory reads (unlike intake).
+    assert "ROBOCO_GROK_EDIT_PERMISSION=deny" in cmd
+    assert "ROBOCO_GROK_BASH_PERMISSION=deny" in cmd
+    assert "ROBOCO_GROK_EXTERNAL_DIR_PERMISSION=deny" in cmd