feat: add Grok Build subscription support

[paucommit]

Summary

• add a pinned Grok Build 1.0.13 ACP harness with per-turn isolation, replay, QM MCP tools, permissions, cancellation, and usage reporting
• add durable xAI device authorization and encrypted per-user subscription credential custody
• expose Grok in model configuration, onboarding, the account connection UI, deployment tooling, and local development
• keep browser-agent model selection limited to its supported Anthropic, OpenAI, and OpenRouter clients

Security and deployment

• verify exact amd64 and arm64 binary and platform-package digests, install the exact release notices, and include the Apache-2.0 license
• enforce managed fail-closed requirements with auto-update, telemetry, feedback, remote fetch, subagents, and always-approve mode disabled
• keep each turn's Grok home owner-only and disposable, and fail closed if the ACP tool surface or runtime version differs from the expected contract
• bind xAI device attempts to the authenticated principal and keep refresh tokens inside the durable keychain

The binary and notices come from the official Grok Build project and open-source announcement.

Validation

• 515 passing affected core tests with one intentional skip, plus 522 CLI, 602 web, 85 admin, and 114 portal tests
• root, CLI, web, admin, and portal typechecks
• ESLint, oxlint, Knip, and Prettier checks
• production web UI build
• amd64 and arm64 production image builds with pinned artifact verification
• pinned Grok 1.0.13 requirements inspection through the Linux bubblewrap launcher
• real Grok 4.6 ACP turn, approved QM MCP tool call, cancellation, and cleanup smoke test

Demo

The screenshots use synthetic, account-neutral data from production-shaped Firefox QA.

Administration	Individual authorization

Account gate	Connection options