feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

Move the last Grok runtime off opencode onto xAI's official `grok` CLI, for full
parity with the Claude path. The intake/secretary chat now runs per-turn headless
`grok -p` invocations that resume one session id (proven live: context carries
across runs), with streaming-json deltas mapped to the existing panel StreamChunk
kinds — the IntakeDriver loop, message source, relay, and idle reaper are reused
unchanged; only the SessionFactory differs (GrokCliSession replaces the
opencode-serve session).

- GrokCliSession + a pure, unit-tested streaming-json -> StreamChunk assembler
  (thought coalesced to one block, text streamed live, end captures the session
  id for -r, fenced-draft fallback, clear errors incl. rate-limit).
- intake propose_draft and secretary read_company_state/read_task/submit_directive
  are now FastMCP servers (roboco-intake / roboco-secretary) wired into
  ~/.grok/config.toml, launched via `uv run --directory /app` to resolve the
  installed package. The secretary tools reuse the shared backend helpers.
- Orchestrator: interactive spawn mounts the subscription auth + per-agent usage
  dir (no metered xAI key, no permission env — grok flags carry per-role perms);
  usage/cost now read a captured usage.json (drop the opencode.db reader, the
  _opencode_db_path/_grok_usage_from_opencode methods, and the cost-cap's
  opencode read). hosts["opencode"] -> hosts["grok_usage"]; OPENCODE_DATA_DIR ->
  GROK_USAGE_DATA_DIR.
- Fix one-shot usage capture: `-s` does not pin the session id (grok generates
  its own), so the entrypoint now reads the real id back from the JSON run log
  and the reader uses it; usage is captured per-turn on the interactive path.
- Delete the opencode layer: opencode_config/opencode_usage/opencode_session, the
  docker/grok/*.js plugins, the old one-shot entrypoint, and their tests.
- Compose (all three files), .env.example, and stale comments updated to the
  grok-CLI runtime; add the SuperGrok auth mount + grok-usage dir.

Gate green: ruff, mypy (296 files), xenon, tests. NAS build/verify pending.

docker-compose.registry.yml

@@ -209,6 +209,9 @@ services:
       # absolute paths on the host. Default to this compose project's ./data.
       ROBOCO_HOST_PROJECT_DIR: ${ROBOCO_HOST_PROJECT_DIR:-/opt/roboco}
       ROBOCO_HOST_CLAUDE_DIR: ${ROBOCO_HOST_CLAUDE_DIR:-${HOME}/.claude}
+      # SuperGrok auth (host ~/.grok) for Grok-CLI agents — the orchestrator
+      # mounts <dir>/auth.json into each Grok agent. Run `grok login` on the host.
+      ROBOCO_HOST_GROK_DIR: ${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}
       ROBOCO_HOST_DATA_DIR: ${ROBOCO_HOST_DATA_DIR:-/opt/roboco/data}
       # Reachable base URL for commit-trailer links — set to your host's LAN
       # address or domain so the links in commit bodies resolve.
@@ -237,12 +240,16 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - ${CLAUDE_AUTH_DIR:-${HOME}/.claude}:/root/.claude
+      # SuperGrok auth — mount host ~/.grok at the SAME host path the orchestrator
+      # hands each Grok agent's `-v`, so its auth.json exists() check passes here
+      # AND the agent bind resolves on the host. `grok login` on the host. RO.
+      - ${GROK_AUTH_DIR:-${HOME}/.grok}:${ROBOCO_HOST_GROK_DIR:-${HOME}/.grok}:ro
       - ${ROBOCO_DATA_DIR:-./data}/mcp-configs:/app/mcp-configs
       - ${ROBOCO_DATA_DIR:-./data}/prompts-generated:/app/prompts-generated
       - ${ROBOCO_DATA_DIR:-./data}/agent-settings:/app/agent-settings
       - ${ROBOCO_DATA_DIR:-./data}/workspaces:/data/workspaces
-      # Per-agent opencode stores (GROK usage/cost capture).
-      - ${ROBOCO_DATA_DIR:-./data}/opencode:/data/opencode
+      # Per-agent GROK usage capture (usage.json -> finalizer).
+      - ${ROBOCO_DATA_DIR:-./data}/grok-usage:/data/grok-usage
       - ${ROBOCO_DATA_DIR:-./data}/logs:/data/logs
       - ${ROBOCO_DATA_DIR:-./data}/briefings:/app/briefings
       - ${ROBOCO_DATA_DIR:-./data}/manifests:/app/manifests