feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

Move the last Grok runtime off opencode onto xAI's official `grok` CLI, for full
parity with the Claude path. The intake/secretary chat now runs per-turn headless
`grok -p` invocations that resume one session id (proven live: context carries
across runs), with streaming-json deltas mapped to the existing panel StreamChunk
kinds — the IntakeDriver loop, message source, relay, and idle reaper are reused
unchanged; only the SessionFactory differs (GrokCliSession replaces the
opencode-serve session).

- GrokCliSession + a pure, unit-tested streaming-json -> StreamChunk assembler
  (thought coalesced to one block, text streamed live, end captures the session
  id for -r, fenced-draft fallback, clear errors incl. rate-limit).
- intake propose_draft and secretary read_company_state/read_task/submit_directive
  are now FastMCP servers (roboco-intake / roboco-secretary) wired into
  ~/.grok/config.toml, launched via `uv run --directory /app` to resolve the
  installed package. The secretary tools reuse the shared backend helpers.
- Orchestrator: interactive spawn mounts the subscription auth + per-agent usage
  dir (no metered xAI key, no permission env — grok flags carry per-role perms);
  usage/cost now read a captured usage.json (drop the opencode.db reader, the
  _opencode_db_path/_grok_usage_from_opencode methods, and the cost-cap's
  opencode read). hosts["opencode"] -> hosts["grok_usage"]; OPENCODE_DATA_DIR ->
  GROK_USAGE_DATA_DIR.
- Fix one-shot usage capture: `-s` does not pin the session id (grok generates
  its own), so the entrypoint now reads the real id back from the JSON run log
  and the reader uses it; usage is captured per-turn on the interactive path.
- Delete the opencode layer: opencode_config/opencode_usage/opencode_session, the
  docker/grok/*.js plugins, the old one-shot entrypoint, and their tests.
- Compose (all three files), .env.example, and stale comments updated to the
  grok-CLI runtime; add the SuperGrok auth mount + grok-usage dir.

Gate green: ruff, mypy (296 files), xenon, tests. NAS build/verify pending.

tests/unit/llm/test_providers.py

@@ -29,14 +29,10 @@ from roboco.models.runtime import OrchestratorAgentConfig
 
 
 @pytest.fixture(autouse=True)
-def _isolate_grok_auth(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> Path:
+def _isolate_grok_auth(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
     """Point GROK_AUTH_HOST_PATH at a fresh tmp dir so tests never mount the real
     ~/.grok. Tests that exercise the auth mount create ``auth.json`` themselves."""
-    monkeypatch.setattr(
-        "roboco.llm.providers.grok.GROK_AUTH_HOST_PATH", str(tmp_path)
-    )
+    monkeypatch.setattr("roboco.llm.providers.grok.GROK_AUTH_HOST_PATH", str(tmp_path))
     return tmp_path
 
 
@@ -81,7 +77,7 @@ class _FakeHost:
     async def _remove_container(self, container_name: str) -> None:
         self.removed.append(container_name)
 
-    def _ensure_opencode_data_dir(self, agent_id: str) -> None:
+    def _ensure_grok_usage_dir(self, agent_id: str) -> None:
         self.data_dirs_ensured.append(agent_id)
 
     def _resolve_host_paths(
@@ -92,7 +88,7 @@ class _FakeHost:
             if config.mcp_config_path
             else None,
             "settings": str(agent_settings_path) if agent_settings_path else None,
-            "opencode": f"/host/data/opencode/{config.agent_id}",
+            "grok_usage": f"/host/data/grok-usage/{config.agent_id}",
         }
 
     def _build_mount_args(
@@ -218,11 +214,12 @@ async def test_grok_spawn_wires_gateway_env_and_image_last() -> None:
     assert "ROBOCO_MCP_CONFIG=/app/mcp-config.json" in cmd
     assert "ROBOCO_AGENT_ID=be-dev-1" in cmd  # renderer computes per-role flags
     assert "ROBOCO_AGENT_MODEL=grok-build" in cmd
-    # Fixed session id so usage capture can locate the run's session store.
-    assert "ROBOCO_AGENT_SESSION_ID=sess-1" in cmd
+    # No session id is injected: grok ignores a requested id, so the entrypoint
+    # reads the real one back from the run log for usage capture.
+    assert not any(c.startswith("ROBOCO_AGENT_SESSION_ID=") for c in cmd)
     # Usage capture: per-agent data dir mounted + the entrypoint's usage file.
     assert host.data_dirs_ensured == ["be-dev-1"]
-    assert "/host/data/opencode/be-dev-1:/home/agent/.grok-usage" in cmd
+    assert "/host/data/grok-usage/be-dev-1:/home/agent/.grok-usage" in cmd
     assert "ROBOCO_GROK_USAGE_FILE=/home/agent/.grok-usage/usage.json" in cmd
     # Identity wiring from the shared host helpers is present.
     assert "ROBOCO_AGENT_TOKEN=hmac-be-dev-1" in cmd