feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

Move the last Grok runtime off opencode onto xAI's official `grok` CLI, for full
parity with the Claude path. The intake/secretary chat now runs per-turn headless
`grok -p` invocations that resume one session id (proven live: context carries
across runs), with streaming-json deltas mapped to the existing panel StreamChunk
kinds — the IntakeDriver loop, message source, relay, and idle reaper are reused
unchanged; only the SessionFactory differs (GrokCliSession replaces the
opencode-serve session).

- GrokCliSession + a pure, unit-tested streaming-json -> StreamChunk assembler
  (thought coalesced to one block, text streamed live, end captures the session
  id for -r, fenced-draft fallback, clear errors incl. rate-limit).
- intake propose_draft and secretary read_company_state/read_task/submit_directive
  are now FastMCP servers (roboco-intake / roboco-secretary) wired into
  ~/.grok/config.toml, launched via `uv run --directory /app` to resolve the
  installed package. The secretary tools reuse the shared backend helpers.
- Orchestrator: interactive spawn mounts the subscription auth + per-agent usage
  dir (no metered xAI key, no permission env — grok flags carry per-role perms);
  usage/cost now read a captured usage.json (drop the opencode.db reader, the
  _opencode_db_path/_grok_usage_from_opencode methods, and the cost-cap's
  opencode read). hosts["opencode"] -> hosts["grok_usage"]; OPENCODE_DATA_DIR ->
  GROK_USAGE_DATA_DIR.
- Fix one-shot usage capture: `-s` does not pin the session id (grok generates
  its own), so the entrypoint now reads the real id back from the JSON run log
  and the reader uses it; usage is captured per-turn on the interactive path.
- Delete the opencode layer: opencode_config/opencode_usage/opencode_session, the
  docker/grok/*.js plugins, the old one-shot entrypoint, and their tests.
- Compose (all three files), .env.example, and stale comments updated to the
  grok-CLI runtime; add the SuperGrok auth mount + grok-usage dir.

Gate green: ruff, mypy (296 files), xenon, tests. NAS build/verify pending.

docker/agent-grok-prompter.Dockerfile

@@ -1,28 +1,19 @@
-# GROK Intake (Prompter) Agent — interactive opencode-serve session on Grok.
+# GROK Intake (Prompter) Agent — interactive grok-CLI session on Grok.
 # =============================================================================
-# The Grok analogue of agent-prompter. Unlike the one-shot Grok runtime (a
-# single `opencode run` that exits), this holds a PERSISTENT `opencode serve`
-# session open, receives the human's messages over HTTP (POST /turn on :9000),
-# and streams each reply back to the panel via the relay. Builds on the Grok
-# runtime image (opencode + @ai-sdk/openai + the secret-scrub plugin); the
-# driver renders opencode.json from the spawn env, then drives the session.
+# The Grok analogue of agent-prompter. Unlike the one-shot Grok runtime (a single
+# `grok -p` that exits), this holds a PERSISTENT conversation: it receives the
+# human's messages over HTTP (POST /turn on :9000) and, per turn, runs a headless
+# `grok -p` that resumes one session id, streaming each reply back to the panel
+# via the relay (see roboco.agent_sdk.grok_intake_main + grok_cli_session). The
+# intake `propose_draft` tool is wired as the roboco-intake MCP server (rendered
+# into ~/.grok/config.toml by the driver). Builds on the Grok runtime image
+# (grok CLI + the roboco venv).
 # =============================================================================
 
 FROM roboco-agent-grok
 
-USER root
-
-# The intake propose_draft tool plugin (the model calls it; the driver turns the
-# call into the panel's draft card), baked into the auto-discovery dir so only
-# the intake image carries it. opencode registers tools from this directory, not
-# from a config `plugin:`-array path (verified live).
-COPY docker/grok/intake-tools.js /home/agent/.config/opencode/plugin/intake-tools.js
-RUN chown agent:agent /home/agent/.config/opencode/plugin/intake-tools.js
-
-USER agent
-
 LABEL role="grok-prompter"
-LABEL description="Intake interviewer on Grok — a long-lived opencode serve session driven by the panel"
+LABEL description="Intake interviewer on Grok — a panel-driven grok-CLI conversation"
 
 # The in-container receiver the orchestrator delivers the human's turns to.
 EXPOSE 9000