feat(grok-cli): wire usage capture into the run (session id + post-run extract)

The provider pins a fixed session id (ROBOCO_AGENT_SESSION_ID, reused from the
agent session id as on the Claude path); the entrypoint passes it to
'grok -p -s <id>' so the run's session store is locatable, then runs the usage
reader post-run (best-effort) to write the captured tokens + cost. The
orchestrator-side finalize that reads that file follows.

docker/scripts/grok-cli-agent-entrypoint.sh

@@ -36,11 +36,16 @@ fi
 RUN_LOG="/tmp/grok-run.json"
 ERR_LOG="/tmp/grok-run.err"
 WORKSPACE="${ROBOCO_WORKSPACE:-$PWD}"
+# A fixed session id (set by the provider) makes the run's session store
+# locatable for usage capture below; absent, grok generates its own.
+SESSION_ARGS=()
+[ -n "${ROBOCO_AGENT_SESSION_ID:-}" ] && SESSION_ARGS=(-s "${ROBOCO_AGENT_SESSION_ID}")
 set +e
 grok -p "${ROBOCO_INITIAL_PROMPT:-}" \
   -m "${ROBOCO_AGENT_MODEL:-grok-build}" \
   --cwd "$WORKSPACE" \
   --output-format json \
+  "${SESSION_ARGS[@]}" \
   "${GROK_ARGS[@]}" \
   < /dev/null > "$RUN_LOG" 2> "$ERR_LOG"
 run_rc=$?
@@ -49,6 +54,13 @@ set -e
 cat "$RUN_LOG"
 [ -s "$ERR_LOG" ] && cat "$ERR_LOG" >&2
 
+# Capture token usage from the grok session store (~/.grok/sessions). The
+# orchestrator reads the written usage file back at finalize — the grok analogue
+# of the Claude transcript. Best-effort; never fails the run. Run from /app for
+# the same module-resolution reason as the render above.
+( cd /app && ROBOCO_GROK_RUN_CWD="$WORKSPACE" \
+    python -m roboco.llm.providers.grok_cli_usage ) || true
+
 # Rate-limit detection (parity with the opencode B4 path): an xAI 429 / quota
 # error ends the run without a terminal verb. Detect it from the run output and
 # exit 75 (EX_TEMPFAIL) so the orchestrator PARKS the grok provider instead of