fix(grok): unbreak workspace-cwd agents, free trapped agents, stop self-PR review

Three bugs surfaced by the first live Grok lifecycle run:

- Dev/QA/doc agents crash-looped at startup with ModuleNotFoundError on
  roboco.llm.providers. The entrypoint ran the opencode-config render from the
  agent's workspace-clone cwd, whose own roboco/ dir shadows /app on the
  sys.path front; a branch without the grok code lacks the providers package.
  Render from /app so the installed package always resolves (the render has no
  cwd dependency — writes global, reads ROBOCO_MCP_CONFIG).

- A budget/loop halt blocked EVERY tool, including i_am_idle, unclaim, and
  i_am_blocked, so a halted agent could neither continue nor stop and flailed —
  one billed model turn per blocked retry. The before-gate now always lets the
  release verbs through so a halted agent can exit cleanly.

- The inbound reviewer ingested the org's OWN PRs (authored by the repo-owner
  account), which can't take a REQUEST_CHANGES review (GitHub 422) and get
  re-reviewed every poll. The normalizer flags author_is_owner and ingestion
  skips them — the reviewer reviews only PRs the org did not author.
  External/contributor PRs are unaffected.

Tests: owner-authored PR flagged + skipped; normalize shape covers the new
field. Gate green on the changed modules (ruff/mypy/xenon + 48 tests).

docker/scripts/grok-agent-entrypoint.sh

@@ -15,7 +15,12 @@ SDK_URL="http://localhost:${SDK_PORT}"
 
 # Generate opencode.json (provider + model + MCP gateway + permissions +
 # instructions). Writes to opencode's global config dir by default.
-python -m roboco.llm.providers.opencode_config
+# Run from /app so `python -m` resolves the INSTALLED roboco package. Dev/doc/qa
+# agents run at their workspace-clone cwd, which has its own `roboco/` dir on the
+# sys.path front (python -m prepends cwd); on a branch without the grok code that
+# clone lacks roboco.llm.providers and shadows /app → ModuleNotFoundError. The
+# config render has no cwd dependency (writes global, reads ROBOCO_MCP_CONFIG).
+( cd /app && python -m roboco.llm.providers.opencode_config )
 
 # --- SDK server bring-up (Claude-parity) ----------------------------------
 # The flow/do MCP servers POST /verb/attempted here for the per-verb circuit