feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

Move the last Grok runtime off opencode onto xAI's official `grok` CLI, for full
parity with the Claude path. The intake/secretary chat now runs per-turn headless
`grok -p` invocations that resume one session id (proven live: context carries
across runs), with streaming-json deltas mapped to the existing panel StreamChunk
kinds — the IntakeDriver loop, message source, relay, and idle reaper are reused
unchanged; only the SessionFactory differs (GrokCliSession replaces the
opencode-serve session).

- GrokCliSession + a pure, unit-tested streaming-json -> StreamChunk assembler
  (thought coalesced to one block, text streamed live, end captures the session
  id for -r, fenced-draft fallback, clear errors incl. rate-limit).
- intake propose_draft and secretary read_company_state/read_task/submit_directive
  are now FastMCP servers (roboco-intake / roboco-secretary) wired into
  ~/.grok/config.toml, launched via `uv run --directory /app` to resolve the
  installed package. The secretary tools reuse the shared backend helpers.
- Orchestrator: interactive spawn mounts the subscription auth + per-agent usage
  dir (no metered xAI key, no permission env — grok flags carry per-role perms);
  usage/cost now read a captured usage.json (drop the opencode.db reader, the
  _opencode_db_path/_grok_usage_from_opencode methods, and the cost-cap's
  opencode read). hosts["opencode"] -> hosts["grok_usage"]; OPENCODE_DATA_DIR ->
  GROK_USAGE_DATA_DIR.
- Fix one-shot usage capture: `-s` does not pin the session id (grok generates
  its own), so the entrypoint now reads the real id back from the JSON run log
  and the reader uses it; usage is captured per-turn on the interactive path.
- Delete the opencode layer: opencode_config/opencode_usage/opencode_session, the
  docker/grok/*.js plugins, the old one-shot entrypoint, and their tests.
- Compose (all three files), .env.example, and stale comments updated to the
  grok-CLI runtime; add the SuperGrok auth mount + grok-usage dir.

Gate green: ruff, mypy (296 files), xenon, tests. NAS build/verify pending.

docker-compose.yaml

@@ -230,7 +230,7 @@ services:
       - agent-base-image
 
   # ==========================================================================
-  # Agent Grok Image Builder (xAI grok-build-0.1 via opencode, OpenAI protocol)
+  # Agent Grok Image Builder (xAI Grok Build via the official grok CLI)
   # ==========================================================================
   agent-grok-image:
     build:
@@ -242,8 +242,8 @@ services:
     depends_on:
       - agent-base-image
 
-  # Interactive Grok roles (intake/secretary) — opencode-serve sessions; built
-  # FROM roboco-agent-grok, so they depend on the Grok runtime image.
+  # Interactive Grok roles (intake/secretary) — panel-driven grok-CLI sessions;
+  # built FROM roboco-agent-grok, so they depend on the Grok runtime image.
   agent-grok-prompter-image:
     build:
       context: .
@@ -306,6 +306,9 @@ services:
       # IMPORTANT: These must be ABSOLUTE paths on the host filesystem
       ROBOCO_HOST_PROJECT_DIR: ${ROBOCO_HOST_PROJECT_DIR:-/volume1/roboco}
       ROBOCO_HOST_CLAUDE_DIR: ${ROBOCO_HOST_CLAUDE_DIR:-/home/renzof/.claude}
+      # SuperGrok auth (host ~/.grok) for Grok-CLI agents — the orchestrator
+      # mounts <dir>/auth.json into each Grok agent. Run `grok login` on the host.
+      ROBOCO_HOST_GROK_DIR: ${ROBOCO_HOST_GROK_DIR:-/home/renzof/.grok}
       ROBOCO_HOST_DATA_DIR: ${ROBOCO_HOST_DATA_DIR:-/volume1/roboco/data}
       # Public base URL for commit-trailer links. Default 127.0.0.1 produces
       # unusable links in commit message bodies; set to NAS LAN IP so
@@ -344,6 +347,11 @@ services:
       - /var/run/docker.sock:/var/run/docker.sock
       # Claude Code auth - mount your ~/.claude directory
       - ${CLAUDE_AUTH_DIR:-/home/renzof/.claude}:/root/.claude
+      # SuperGrok auth — mount the host ~/.grok at the SAME host path the
+      # orchestrator passes to each Grok agent's `-v`, so its auth.json exists()
+      # check passes here AND the agent bind resolves on the host. `grok login`
+      # on the host writes auth.json (auto-refreshing). Read-only.
+      - ${GROK_AUTH_DIR:-/home/renzof/.grok}:${ROBOCO_HOST_GROK_DIR:-/home/renzof/.grok}:ro
       # Shared config directory for MCP configs (writable)
       - ${ROBOCO_DATA_DIR:-./data}/mcp-configs:/app/mcp-configs
       # Generated prompts directory - composed at runtime from layers
@@ -352,9 +360,9 @@ services:
       - ${ROBOCO_DATA_DIR:-./data}/agent-settings:/app/agent-settings
       # Agent workspaces (git clones) - persisted across restarts
       - ${ROBOCO_DATA_DIR:-./data}/workspaces:/data/workspaces
-      # Per-agent opencode stores (GROK usage/cost capture): each Grok agent
-      # writes opencode.db under <agent_id>/; the finalizer reads it back here.
-      - ${ROBOCO_DATA_DIR:-./data}/opencode:/data/opencode
+      # Per-agent GROK usage capture: each Grok agent writes usage.json under
+      # <agent_id>/; the finalizer reads the captured tokens/cost back here.
+      - ${ROBOCO_DATA_DIR:-./data}/grok-usage:/data/grok-usage
       # Persistent logs — survive `docker compose down/up`. Orchestrator and
       # each spawned agent write structured logs here so we can audit past
       # runs instead of relying on ephemeral `docker logs`.