feat(grok): surface intake/secretary in the mix-mode picker; doc guardrail parity

- Panel: add intake-1 (prompter) and secretary-1 to the mix-mode per-agent
  routing list so an operator can assign Grok (or Claude) to the interactive
  roles from the UI; assigning a Grok model routes them to the opencode-serve
  image. tsc + eslint clean.
- opencode_config: correct the now-stale parity note — bash-guard is ported
  (secret-scrub.js) and usage/cost is captured (opencode store); the remaining
  gap is the budget/loop/stop/prompt-injection hooks, which need a sidecar
  plugin (open decision), with ROBOCO_GROK_BASH_PERMISSION as the interim gate.

panel/src/components/settings/ai-routing-card.tsx

@@ -74,6 +74,11 @@ const AGENTS: { slug: string; label: string }[] = [
   { slug: "ux-dev-1", label: "UX/UI Dev" },
   { slug: "ux-qa", label: "UX/UI QA" },
   { slug: "ux-doc", label: "UX/UI Documenter" },
+  // Interactive (held-open chat) roles. Claude (SDK driver) and Grok (opencode
+  // serve) are the supported runtimes; assigning a Grok model routes them to
+  // the grok-prompter / grok-secretary image.
+  { slug: "intake-1", label: "Intake (Prompter)" },
+  { slug: "secretary-1", label: "Secretary" },
 ];
 
 export function AIRoutingCard() {

roboco/llm/providers/opencode_config.py

@@ -20,11 +20,15 @@ Config shape per opencode docs (https://opencode.ai/docs/config):
     idle stream hangs the parent run with no recovery (observed live on a PR
     review). The request/stream timeouts below are the defence-in-depth backstop.
 
-KNOWN PARITY GAP (tracked for the opencode-plugin follow-up with xAI): RoboCo's
+GUARDRAIL PARITY: the bash-guard (PAT-scrub) deny rules ARE ported to opencode
-bash-guard (PAT-scrub) and transcript-based usage/cost capture are Claude Code
+via the ``secret-scrub.js`` plugin (``tool.execute.before``), and token
-hooks; they do not transfer to the opencode runtime. ``bash`` permission is
+usage/cost IS captured from opencode's SQLite store at finalize. The remaining
-operator-tunable (``ROBOCO_GROK_BASH_PERMISSION``) so a deployment can fail
+gap vs Claude Code is the budget / loop-detector / stop-guard / prompt-injection
-closed (``deny``/``ask``) until a security-parity opencode plugin lands.
+hooks — they fire against the SDK ``:9000`` server and have no opencode
+equivalent yet; closing them needs an opencode plugin that POSTs to a sidecar
+(a tracked follow-up / open decision). ``bash`` permission stays operator-tunable
+(``ROBOCO_GROK_BASH_PERMISSION``) so a deployment can fail closed
+(``deny``/``ask``) meanwhile.
 """
 
 from __future__ import annotations