feat(grok-cli): GrokCliProvider — subscription auth mount, mirrors ClaudeCodeProvider

Replace the opencode GrokProvider with GrokCliProvider: reuses the orchestrator's
shared mount/auth/git assembly (gateway + identity) exactly like the Claude path,
mounts the host ~/.grok/auth.json read-only (SuperGrok subscription) instead of
injecting an xAI key, and sets the slim env the grok-cli entrypoint + renderer
read (ROBOCO_AGENT_ID for per-role flags, model, mcp-config, prompt). Provider
routing fields are blanked before the shared step so the grok endpoint is never
mislabelled ANTHROPIC_*. Per-role permission logic now lives in grok_cli_config,
so the provider is slim. Registry/orchestrator/exports updated; provider tests
rewritten for the CLI behavior (no XAI key, auth mount present/absent).

tests/unit/runtime/test_provider_routing.py

@@ -1,6 +1,6 @@
 """The orchestrator routes only dedicated-backend providers through the registry.
 
-GROK gets the GrokProvider; Anthropic / Ollama Cloud / self-hosted (and any
+GROK gets the GrokCliProvider; Anthropic / Ollama Cloud / self-hosted (and any
 unknown value) return None so ``_spawn_container`` runs its built-in Claude Code
 path unchanged. This keeps the GROK addition purely additive.
 """
@@ -9,7 +9,7 @@ from __future__ import annotations
 
 from unittest.mock import patch
 
-from roboco.llm.providers import GrokProvider
+from roboco.llm.providers import GrokCliProvider
 from roboco.runtime.orchestrator import AgentOrchestrator
 
 
@@ -21,7 +21,7 @@ def _make_orch() -> AgentOrchestrator:
 
 
 def test_provider_for_grok_returns_grok_provider() -> None:
-    assert isinstance(_make_orch()._provider_for("grok"), GrokProvider)
+    assert isinstance(_make_orch()._provider_for("grok"), GrokCliProvider)
 
 
 def test_provider_for_anthropic_returns_none() -> None: