fix(grok): make the live interactive path work — store perms, error surfacing, variant

Found by actually running opencode serve locally (the path was doc-verified but
never executed). Three fixes:

1. EACCES on the opencode store mount (the live intake crash): on Linux docker
   auto-creates a missing bind source as root:root, so the non-root agent user
   could not mkdir/write in /home/agent/.local/share/opencode and opencode died
   at boot. _ensure_opencode_data_dir pre-creates the per-agent dir 0777 before
   the mount (one-shot via the _GrokHost seam, interactive in both spawns).

2. Silent blank reply on a model error: opencode reports a turn failure in
   info.error with parts=[], NOT as a part — verified live (a bad xAI key
   returns info.error APIError). send() / normalize_opencode_message now surface
   it as an "error" StreamChunk so a failed turn is never blank (the original
   intake bug class). Confirmed live: the error now renders.

3. Reasoning variant on the serve path: the live OpenAPI shows the message body
   accepts a "variant" field (it is NOT CLI-only, as the docs implied), so the
   pin is unblocked. send() passes ROBOCO_GROK_VARIANT as the per-turn variant;
   the orchestrator sets it per-role (_reasoning_effort_for) for interactive
   Grok, the same lever as the one-shot --variant.

opencode serve startup, POST /session, session-id extraction, the part-type
mapping (text/reasoning/tool), and the error path are all validated against a
live opencode 1.17.8. A real successful grok reply still needs a funded key.

tests/unit/runtime/test_interactive_grok_spawn.py

@@ -24,7 +24,11 @@ _HOSTS: dict[str, str | None] = {
 
 
 def _intake_spec(
-    provider_type: str, *, base_url: str | None, token: str | None
+    provider_type: str,
+    *,
+    base_url: str | None,
+    token: str | None,
+    grok_variant: str | None = None,
 ) -> _IntakeRunSpec:
     return _IntakeRunSpec(
         container_name="roboco-agent-intake-1",
@@ -40,23 +44,38 @@ def _intake_spec(
         provider_auth_token=token,
         provider_type=provider_type,
         model="grok-build-0.1",
+        grok_variant=grok_variant,
     )
 
 
 def test_intake_grok_uses_openai_env_and_opencode_mount() -> None:
     cmd = AgentOrchestrator._build_intake_run_cmd(
-        _intake_spec("grok", base_url="https://api.x.ai/v1", token="xai-key")
+        _intake_spec(
+            "grok",
+            base_url="https://api.x.ai/v1",
+            token="xai-key",
+            grok_variant="minimal",
+        )
     )
     assert "OPENAI_BASE_URL=https://api.x.ai/v1" in cmd
     assert "OPENAI_API_KEY=xai-key" in cmd
     assert "ROBOCO_AGENT_MODEL=grok-build-0.1" in cmd
     assert "ROBOCO_SYSTEM_PROMPT=/app/system-prompt.md" in cmd
     assert "/h/oc/intake-1:/home/agent/.local/share/opencode" in cmd
+    # Per-role reasoning effort reaches the container for the serve driver.
+    assert "ROBOCO_GROK_VARIANT=minimal" in cmd
     assert cmd[-1] == GROK_PROMPTER_IMAGE
     # The xAI endpoint is never mislabelled as Anthropic.
     assert not any(c.startswith("ANTHROPIC_") for c in cmd)
 
 
+def test_intake_grok_omits_variant_when_unset() -> None:
+    cmd = AgentOrchestrator._build_intake_run_cmd(
+        _intake_spec("grok", base_url="https://api.x.ai/v1", token="xai-key")
+    )
+    assert not any(c.startswith("ROBOCO_GROK_VARIANT=") for c in cmd)
+
+
 def test_intake_anthropic_keeps_anthropic_env() -> None:
     cmd = AgentOrchestrator._build_intake_run_cmd(
         _intake_spec("anthropic", base_url="https://api.anthropic.com", token="sk-ant")