fix(grok): deliver intake draft via the relay + correct opencode-mechanism docs

Live end-to-end verification (opencode 1.17.8 + grok-build-0.1) of the WHOLE
integration, then fixes for what it surfaced:

1) Intake draft card (FUNCTIONAL): opencode's synchronous serve reply
   (POST /session/:id/message) returns only [step-start, text, step-finish] — it
   does NOT include tool-call parts, so the driver could never extract the
   propose_draft draft. intake-tools.js now POSTs the draft straight to the
   prompter-live relay (/api/prompter/live/{session}/events, the same endpoint
   the driver's relay sink uses), so the panel renders the card regardless.
   Verified live: grok calls propose_draft -> the relay receives the draft.

2) Correct misattributed opencode "bugs" (DOCS): earlier comments asserted as
   general opencode behavior that a provider.xai block / npm override / config
   plugin:-array "break" registration. Re-testing showed those were artifacts of
   a PROJECT-level .opencode/opencode.json; from the GLOBAL config (which
   opencode_config writes) the built-in provider, model resolution, the plugin
   array AND the auto-discovery dir all work, and MCP gateway verbs register
   (delivery agents verified). Reframed the comments as design choices (built-in
   provider + XAI_API_KEY env + plugins baked in the auto-discovery dir with
   named exports) and dropped the false claims.

3) Reasoning --variant: passing it does not error, but whether opencode applies a
   named reasoning variant to grok-build-0.1 (no provider-defined variants) is
   UNVERIFIED — comment softened from a "~54% cut" claim to best-effort,
   measure-on-NAS.

Verified live this session: one-shot delivery (model + MCP verbs + plugins +
hooks), secretary tools (read_company_state + submit_directive -> backend with
token), intake draft (relay), grok built-in-provider tool-calling. Remaining
NAS-only: full container assembly (SDK :9000 startup, entrypoint hooks, 429
parking) + the --variant cost measurement. Gate green (ruff/mypy + 51 tests;
node --check the plugins).

docker/grok/secretary-tools.js

@@ -66,11 +66,10 @@ async function callBackend(method, path, body) {
 
 const asText = (data) => JSON.stringify(data);
 
-// Named export + loaded from the plugin auto-discovery dir
-// (~/.config/opencode/plugin/) — opencode 1.17.8 does NOT register tools from a
-// config `plugin:`-array absolute path; only directory auto-discovery + a named
-// export registers Hooks.tool (verified live: the model called the tool and the
-// backend received the request).
+// Named export (opencode's plugin convention) + baked into the plugin
+// auto-discovery dir (~/.config/opencode/plugin/) at image build. Verified live
+// against grok-build-0.1: the model called read_company_state + submit_directive
+// and the backend received both requests with the X-Agent-Token.
 export const RobocoSecretaryTools = async () => ({
   tool: {
     read_company_state: tool({