Add Groq platform (provider 4)

The 7th registry row and the first pure-pattern cycle: id "groq",
GROQ_API_KEY > auth.json "groq" scope, https://api.groq.com/openai/v1
with KIGI_GROQ_BASE_URL override, OpenAI listing + ChatCompletions +
Passthrough dialect (Groq accepts the OpenAI-style reasoning_effort
scalar verbatim), enrichment-backed metadata with the tool-calling
restriction (the listing carries whisper/tts/guard noise — 8 of 15
enrichment entries are non-chat).

Review verdict: faithful pattern repeat, zero blocking findings — row
facts verified against live Groq docs, registry integrity at 7, e2e
proven strong on both axes (restriction + dialect mapping). Added the
recommended pin: managed keys split on the FIRST slash, so Groq's
provider-native slashed ids (openai/gpt-oss-120b and 10 more) round-trip
as groq/openai/gpt-oss-120b → (Groq, openai/gpt-oss-120b).

Also fixes a pre-existing test race this cycle surfaced: the enterprise-
endpoints test asserted moonshot's fixed base while non-serial, racing
serial tests that legitimately point KIGI_MOONSHOT_CN_BASE_URL at
wiremock; now serial + env-unset like its documented siblings. Two
display-only advisories logged as tracked debt (Groq's delta.reasoning
field invisible in the TUI; platform-generic rate-limit copy).

crates/codegen/kigi-shell/src/agent/config.rs

@@ -6638,7 +6638,12 @@ reasoning_effort = "low"
         );
     }
     #[test]
+    #[serial]
     fn e2e_enterprise_endpoints_only_no_model_override() {
+        // Hermetic: the moonshot-base assertion below races serial tests
+        // that legitimately point KIGI_MOONSHOT_CN_BASE_URL at wiremock —
+        // this test was non-serial and read the env mid-guard.
+        let _cn = EnvGuard::unset(kigi_models::MOONSHOT_CN_BASE_URL_ENV);
         let (_, models) = resolve_models_from_toml(
             r#"
             [endpoints]