fix(grok): address adversarial-review findings across the grok-CLI conversion

A 7-dimension adversarial review (find -> independently refute) surfaced 14 real
issues; fixed each:

Runtime bugs
- GrokCliSession.send drained stdout fully BEFORE stderr — a >64KB stderr burst
  would deadlock the turn forever (spinner never clears). Drain stderr
  concurrently, and add a per-turn watchdog (ROBOCO_GROK_TURN_TIMEOUT_SECONDS,
  default 600s) that kills a wedged process and emits error+turn_end.
- Crash-restarted grok agents launched `grok -p ""` (empty prompt) — Claude gets
  a scan-for-work fallback. Default the prompt in _spawn_container so every
  dedicated provider gets it too.
- _grok_usage_json read /data/grok-usage unconditionally while its writers branch
  compose-vs-local, so a local-mode agent finalized at $0 and the cost-cap was
  inert. Single-source the path in a new _grok_usage_dir helper (read == write).
- GrokCliSession secretary role fell through to "unknown" (get_agent_role returns
  a truthy sentinel, never None), defeating the ROBOCO_AGENT_ROLE fallback.

Parity / hardening
- --deny set was missing `git tag -d` / `git reflog delete` that the Claude
  bash-guard blocks — added them (the "same set" claim is now true).
- Interactive mains now install the bash-guard hook too (defense-in-depth).
- Compose: collapse the GROK_AUTH_DIR / ROBOCO_HOST_GROK_DIR auth-mount pair into
  one canonical var so a partial override can't silently break agent auth.

Docs / comments
- Panel routing card + architecture security doc no longer say Grok runs on the
  deleted opencode runtime; orchestrator comments point at the renamed entrypoint.

Tests
- Cover the interactive _render_grok_config MCP wiring (ModuleNotFound guard +
  secretary HMAC env), the cost-cap kill-failure + interactive relay-close paths,
  the local-mode usage read, the role fallback, the turn timeout, and the new
  git denies. (#13 — a separate grok "Write" tool — investigated: grok's only
  built-in file-mutation tool is search_replace, already removed; no gap.)

Gate green: ruff, mypy, xenon, tests.

tests/unit/runtime/test_grok_cost_budget.py

@@ -14,12 +14,18 @@ from unittest.mock import AsyncMock
 
 import pytest
 from roboco.models.runtime import AgentInstance
-from roboco.runtime.orchestrator import AgentOrchestrator, AgentState
+from roboco.runtime.orchestrator import (
+    INTAKE_AGENT_ID,
+    AgentOrchestrator,
+    AgentState,
+)
 
 
-def _grok_instance(provider_type: str = "grok") -> AgentInstance:
+def _grok_instance(
+    provider_type: str = "grok", agent_id: str = "be-dev-1"
+) -> AgentInstance:
     cfg = type("C", (), {"provider_type": provider_type, "model": "grok-build"})()
-    return AgentInstance(agent_id="be-dev-1", state=AgentState.ACTIVE, config=cfg)
+    return AgentInstance(agent_id=agent_id, state=AgentState.ACTIVE, config=cfg)
 
 
 def _orch(
@@ -28,11 +34,12 @@ def _orch(
     cap: float,
     cost: float,
     provider_type: str = "grok",
+    agent_id: str = "be-dev-1",
 ) -> tuple[AgentOrchestrator, AsyncMock]:
     """A bare orchestrator with the cost reader + container removal stubbed."""
     orch = AgentOrchestrator.__new__(AgentOrchestrator)
     orch._grok_max_cost_usd = cap
-    orch._instances = {"be-dev-1": _grok_instance(provider_type)}
+    orch._instances = {agent_id: _grok_instance(provider_type, agent_id)}
     monkeypatch.setattr(orch, "_grok_cost_usd", lambda _agent_id: cost)
     remove_mock = AsyncMock()
     monkeypatch.setattr(orch, "_remove_container", remove_mock)
@@ -79,3 +86,42 @@ async def test_non_grok_container_is_ignored(monkeypatch: pytest.MonkeyPatch) ->
 
     remove_mock.assert_not_awaited()
     assert "be-dev-1" in orch._instances
+
+
+@pytest.mark.asyncio
+async def test_kill_failure_keeps_instance_for_retry(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # If `docker rm` raises, the over-budget container must STAY registered so the
+    # sweep retries next tick (the except `continue` resilience contract).
+    orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=7.5)
+    remove_mock.side_effect = RuntimeError("docker rm failed")
+
+    await orch._enforce_grok_cost_budget()
+
+    remove_mock.assert_awaited_once()
+    assert "be-dev-1" in orch._instances  # not evicted -> retried next tick
+
+
+@pytest.mark.asyncio
+async def test_interactive_kill_closes_the_relay(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    # Killing an interactive (intake/secretary) container over budget must close
+    # its panel relay with a reason so the chat ends cleanly, not a frozen SSE.
+    orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=9.0, agent_id=INTAKE_AGENT_ID)
+    registry = type("R", (), {"calls": []})()
+    registry.close_by_agent = lambda agent_id, error: registry.calls.append(
+        (agent_id, error)
+    )
+    monkeypatch.setattr(
+        "roboco.services.prompter_live.get_live_registry", lambda: registry
+    )
+
+    await orch._enforce_grok_cost_budget()
+
+    remove_mock.assert_awaited_once_with(f"roboco-agent-{INTAKE_AGENT_ID}")
+    assert INTAKE_AGENT_ID not in orch._instances
+    assert len(registry.calls) == 1
+    assert registry.calls[0][0] == INTAKE_AGENT_ID
+    assert "cost" in registry.calls[0][1].lower()

tests/unit/runtime/test_grok_usage_finalize.py

@@ -10,10 +10,12 @@ output (it bills at the output rate).
 from __future__ import annotations
 
 import json
+import tempfile
 from typing import TYPE_CHECKING
 
 import pytest
 from roboco.models.runtime import AgentInstance
+from roboco.runtime import orchestrator as orch_mod
 from roboco.runtime.orchestrator import AgentOrchestrator
 
 if TYPE_CHECKING:
@@ -75,3 +77,35 @@ async def test_resolve_final_usage_routes_grok_to_usage_json(
 
     # No SDK fetch / transcript read for GROK — usage comes from usage.json.
     assert await orch._resolve_final_token_usage("be-dev-1") == (0, 12, 0, 0)
+
+
+def test_grok_usage_dir_branches_compose_vs_local(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setattr(orch_mod, "PROJECT_HOST_PATH", "")
+    local = AgentOrchestrator._grok_usage_dir("be-dev-1")
+    assert "roboco-grok-usage" in str(local)
+    assert local.name == "be-dev-1"
+
+    monkeypatch.setattr(orch_mod, "PROJECT_HOST_PATH", "/volume1/roboco")
+    monkeypatch.setattr(orch_mod, "GROK_USAGE_DATA_DIR", "/data/grok-usage")
+    assert str(AgentOrchestrator._grok_usage_dir("be-dev-1")) == (
+        "/data/grok-usage/be-dev-1"
+    )
+
+
+def test_grok_usage_json_reads_the_real_local_dir(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    # The un-mocked read path must find usage.json in the SAME branched dir the
+    # writer mounts (the local-mode fix: read side mirrors the write side).
+    monkeypatch.setattr(orch_mod, "PROJECT_HOST_PATH", "")
+    monkeypatch.setattr(tempfile, "gettempdir", lambda: str(tmp_path))
+    udir = tmp_path / "roboco-grok-usage" / "be-dev-1"
+    udir.mkdir(parents=True)
+    (udir / "usage.json").write_text(
+        json.dumps({"total_tokens": 55, "cost_usd": 0.1}), encoding="utf-8"
+    )
+    orch = AgentOrchestrator.__new__(AgentOrchestrator)
+    assert orch._grok_usage_tokens("be-dev-1") == (0, 55, 0, 0)
+    assert orch._grok_cost_usd("be-dev-1") == 0.1  # noqa: PLR2004