feat(grok): prompt-injection guard for Grok (parity with the Claude hook)

The injection guard is RoboCo's own hook (user-prompt-hook.sh), not a runtime
built-in, so it can be recreated at our input boundary regardless of runtime —
opencode's lack of a blocking pre-prompt hook is irrelevant.

- prompt_guard.detect_injection: the deny patterns ported to reusable Python.
- IntakeDriver._run_turn scans every interactive turn before sending it to the
  model and denies a match as an error chunk. Covers BOTH Grok (opencode) and
  the Claude SDK intake (which runs with setting_sources=[] and so never loaded
  the bash hook — it was unguarded too).
- The one-shot grok entrypoint scans ROBOCO_INITIAL_PROMPT and refuses a
  poisoned task prompt (parity with the Claude UserPromptSubmit deny).
- Broadened the pattern (Python + the bash hook, kept in sync) to catch the
  multi-qualifier canonical phrasing "ignore all previous instructions", which
  the single-qualifier original missed — without false-positiving on
  "ignore the linting rules" (an intermediate non-qualifier word breaks it).

So Grok now has the command/secret-exfil guard (secret-scrub), the cost cap,
AND the injection guard. Verified: 94 agent_sdk tests pass; bash + Python agree
on detect/miss cases.

docker/scripts/user-prompt-hook.sh

@@ -33,7 +33,7 @@ low=$(printf '%s' "$prompt" | tr "[:upper:]" "[:lower:]")
 # Classic injection patterns. Anchored loosely — any paragraph start is fair
 # game since these appear mid-message when pasted into A2A content.
 denied=""
-if echo "$low" | grep -qE '(^|[[:space:]>])(ignore|disregard|forget)[[:space:]]+(previous|above|all|prior)[[:space:]]+(instructions|rules|guidelines|context)'; then
+if echo "$low" | grep -qE '(^|[[:space:]>])(ignore|disregard|forget)[[:space:]]+((the|all|any|those|these|previous|above|prior|earlier|original|initial|system)[[:space:]]+)+(instructions|rules|guidelines|context|prompt|directives)'; then
     denied="ignore/disregard/forget previous instructions"
 elif echo "$low" | grep -qE '(^|[[:space:]>])you[[:space:]]+are[[:space:]]+now([[:space:]]+a|[[:space:]]+an|[[:space:]]+the|:)'; then
     denied="role override attempt (you are now ...)"