feat(grok): convert interactive intake/secretary to the grok CLI; delete opencode

Move the last Grok runtime off opencode onto xAI's official `grok` CLI, for full
parity with the Claude path. The intake/secretary chat now runs per-turn headless
`grok -p` invocations that resume one session id (proven live: context carries
across runs), with streaming-json deltas mapped to the existing panel StreamChunk
kinds — the IntakeDriver loop, message source, relay, and idle reaper are reused
unchanged; only the SessionFactory differs (GrokCliSession replaces the
opencode-serve session).

- GrokCliSession + a pure, unit-tested streaming-json -> StreamChunk assembler
  (thought coalesced to one block, text streamed live, end captures the session
  id for -r, fenced-draft fallback, clear errors incl. rate-limit).
- intake propose_draft and secretary read_company_state/read_task/submit_directive
  are now FastMCP servers (roboco-intake / roboco-secretary) wired into
  ~/.grok/config.toml, launched via `uv run --directory /app` to resolve the
  installed package. The secretary tools reuse the shared backend helpers.
- Orchestrator: interactive spawn mounts the subscription auth + per-agent usage
  dir (no metered xAI key, no permission env — grok flags carry per-role perms);
  usage/cost now read a captured usage.json (drop the opencode.db reader, the
  _opencode_db_path/_grok_usage_from_opencode methods, and the cost-cap's
  opencode read). hosts["opencode"] -> hosts["grok_usage"]; OPENCODE_DATA_DIR ->
  GROK_USAGE_DATA_DIR.
- Fix one-shot usage capture: `-s` does not pin the session id (grok generates
  its own), so the entrypoint now reads the real id back from the JSON run log
  and the reader uses it; usage is captured per-turn on the interactive path.
- Delete the opencode layer: opencode_config/opencode_usage/opencode_session, the
  docker/grok/*.js plugins, the old one-shot entrypoint, and their tests.
- Compose (all three files), .env.example, and stale comments updated to the
  grok-CLI runtime; add the SuperGrok auth mount + grok-usage dir.

Gate green: ruff, mypy (296 files), xenon, tests. NAS build/verify pending.

tests/unit/runtime/test_grok_cost_budget.py

@@ -1,10 +1,11 @@
 """GROK cost budget kill-switch: kill a live container over the cost ceiling.
 
-opencode exposes no usage hook to a plugin, so the budget kill-switch lives in
-the orchestrator: it reads each live GROK container's cumulative opencode cost
-and kills + evicts it past ROBOCO_GROK_MAX_COST_USD (also catching runaway-loop
-token burn). The cost computation itself is covered in opencode_usage tests; here
-cost_for_session is stubbed so the kill DECISION is exercised deterministically.
+The grok CLI exposes no live usage hook, so the budget kill-switch lives in the
+orchestrator: it reads each live GROK container's captured cost (from its
+usage.json, via ``_grok_cost_usd``) and kills + evicts it past
+ROBOCO_GROK_MAX_COST_USD (also catching runaway-loop token burn). The usage.json
+read is covered in the grok usage tests; here ``_grok_cost_usd`` is stubbed so the
+kill DECISION is exercised deterministically.
 """
 
 from __future__ import annotations
@@ -15,22 +16,32 @@ import pytest
 from roboco.models.runtime import AgentInstance
 from roboco.runtime.orchestrator import AgentOrchestrator, AgentState
 
-_COST_FN = "roboco.llm.providers.opencode_usage.cost_for_session"
-
 
 def _grok_instance(provider_type: str = "grok") -> AgentInstance:
-    cfg = type("C", (), {"provider_type": provider_type, "model": "grok-build-0.1"})()
+    cfg = type("C", (), {"provider_type": provider_type, "model": "grok-build"})()
     return AgentInstance(agent_id="be-dev-1", state=AgentState.ACTIVE, config=cfg)
 
 
+def _orch(
+    monkeypatch: pytest.MonkeyPatch,
+    *,
+    cap: float,
+    cost: float,
+    provider_type: str = "grok",
+) -> tuple[AgentOrchestrator, AsyncMock]:
+    """A bare orchestrator with the cost reader + container removal stubbed."""
+    orch = AgentOrchestrator.__new__(AgentOrchestrator)
+    orch._grok_max_cost_usd = cap
+    orch._instances = {"be-dev-1": _grok_instance(provider_type)}
+    monkeypatch.setattr(orch, "_grok_cost_usd", lambda _agent_id: cost)
+    remove_mock = AsyncMock()
+    monkeypatch.setattr(orch, "_remove_container", remove_mock)
+    return orch, remove_mock
+
+
 @pytest.mark.asyncio
 async def test_cost_over_cap_kills_and_evicts(monkeypatch: pytest.MonkeyPatch) -> None:
-    orch = AgentOrchestrator.__new__(AgentOrchestrator)
-    orch._grok_max_cost_usd = 5.0
-    orch._instances = {"be-dev-1": _grok_instance()}
-    remove_mock = AsyncMock()
-    monkeypatch.setattr(orch, "_remove_container", remove_mock)
-    monkeypatch.setattr(_COST_FN, lambda *_a, **_k: (None, 7.5))
+    orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=7.5)
 
     await orch._enforce_grok_cost_budget()
 
@@ -40,12 +51,7 @@ async def test_cost_over_cap_kills_and_evicts(monkeypatch: pytest.MonkeyPatch) -
 
 @pytest.mark.asyncio
 async def test_cost_under_cap_spares(monkeypatch: pytest.MonkeyPatch) -> None:
-    orch = AgentOrchestrator.__new__(AgentOrchestrator)
-    orch._grok_max_cost_usd = 5.0
-    orch._instances = {"be-dev-1": _grok_instance()}
-    remove_mock = AsyncMock()
-    monkeypatch.setattr(orch, "_remove_container", remove_mock)
-    monkeypatch.setattr(_COST_FN, lambda *_a, **_k: (None, 1.0))
+    orch, remove_mock = _orch(monkeypatch, cap=5.0, cost=1.0)
 
     await orch._enforce_grok_cost_budget()
 
@@ -55,12 +61,7 @@ async def test_cost_under_cap_spares(monkeypatch: pytest.MonkeyPatch) -> None:
 
 @pytest.mark.asyncio
 async def test_cap_zero_disables_the_sweep(monkeypatch: pytest.MonkeyPatch) -> None:
-    orch = AgentOrchestrator.__new__(AgentOrchestrator)
-    orch._grok_max_cost_usd = 0.0
-    orch._instances = {"be-dev-1": _grok_instance()}
-    remove_mock = AsyncMock()
-    monkeypatch.setattr(orch, "_remove_container", remove_mock)
-    monkeypatch.setattr(_COST_FN, lambda *_a, **_k: (None, 999.0))
+    orch, remove_mock = _orch(monkeypatch, cap=0.0, cost=999.0)
 
     await orch._enforce_grok_cost_budget()
 
@@ -70,12 +71,9 @@ async def test_cap_zero_disables_the_sweep(monkeypatch: pytest.MonkeyPatch) -> N
 
 @pytest.mark.asyncio
 async def test_non_grok_container_is_ignored(monkeypatch: pytest.MonkeyPatch) -> None:
-    orch = AgentOrchestrator.__new__(AgentOrchestrator)
-    orch._grok_max_cost_usd = 5.0
-    orch._instances = {"be-dev-1": _grok_instance(provider_type="anthropic")}
-    remove_mock = AsyncMock()
-    monkeypatch.setattr(orch, "_remove_container", remove_mock)
-    monkeypatch.setattr(_COST_FN, lambda *_a, **_k: (None, 999.0))
+    orch, remove_mock = _orch(
+        monkeypatch, cap=5.0, cost=999.0, provider_type="anthropic"
+    )
 
     await orch._enforce_grok_cost_budget()