M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-pager-render/src/gboom/mod.rs

@@ -2,7 +2,7 @@
 //! the terminal via the kitty graphics protocol.
 //!
 //! Typing `/gboom` (and nothing else) opens a modal overlay — the same
-//! surface the imagine-video player uses — and streams PNG frames via
+//! surface the inline video player uses — and streams PNG frames via
 //! per-frame kitty `a=T` retransmission at the ~30 fps animation tick. The
 //! simulation steps with wall-clock `dt`, so gameplay speed is independent
 //! of the achieved frame rate.

crates/codegen/kigi-pager-render/src/link_opener.rs

@@ -92,7 +92,7 @@ fn build_open_path_command(path: &std::path::Path) -> std::process::Command {
 /// - **Windows**: `explorer.exe /select,<path>` reveals + highlights the file
 ///   in Explorer. We deliberately avoid `cmd /c start`, whose `%VAR%`
 ///   expansion corrupts the percent-encoded session-directory segment in
-///   imagine media paths (e.g. `…\C%3A%5CUsers…`).
+///   media paths (e.g. `…\C%3A%5CUsers…`).
 /// - **macOS / Linux**: `open` / `xdg-open` open the file in its default app.
 pub fn open_path(path: &std::path::Path) -> bool {
     // Never launch a real GUI app in tests.
@@ -210,28 +210,6 @@ pub fn open_url_if_safe(url: &str, filter: SchemeFilter) -> bool {
     }
 }
 
-/// Ensure `url` carries the given query parameter, returning the rewritten URL.
-///
-/// If the URL already contains a parameter with that name, its value is left
-/// untouched (the caller upstream may have intentionally set one). On parse
-/// failure, the original string is returned unchanged so this is safe to apply
-/// to opener input from untrusted sources.
-///
-/// Used by the SuperGrok upsell flow to attribute clicks to `referrer=grok-build`,
-/// matching the OAuth consent screen and x.ai/cli marketing links regardless of
-/// what the remote settings `gate_url` value happens to be.
-pub fn ensure_query_param(url: &str, key: &str, value: &str) -> String {
-    let Ok(mut parsed) = url::Url::parse(url) else {
-        return url.to_string();
-    };
-    let already_present = parsed.query_pairs().any(|(k, _)| k == key);
-    if already_present {
-        return parsed.to_string();
-    }
-    parsed.query_pairs_mut().append_pair(key, value);
-    parsed.to_string()
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -383,55 +361,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn ensure_query_param_appends_when_missing() {
-        let out = ensure_query_param("https://grok.com/supergrok", "referrer", "grok-build");
-        assert_eq!(out, "https://grok.com/supergrok?referrer=grok-build");
-    }
-
-    #[test]
-    fn ensure_query_param_preserves_existing_value() {
-        let out = ensure_query_param(
-            "https://grok.com/supergrok?referrer=other",
-            "referrer",
-            "grok-build",
-        );
-        assert_eq!(out, "https://grok.com/supergrok?referrer=other");
-    }
-
-    #[test]
-    fn ensure_query_param_keeps_other_query_pairs() {
-        let out = ensure_query_param(
-            "https://grok.com/supergrok?heavy=1",
-            "referrer",
-            "grok-build",
-        );
-        assert_eq!(
-            out,
-            "https://grok.com/supergrok?heavy=1&referrer=grok-build"
-        );
-    }
-
-    #[test]
-    fn ensure_query_param_preserves_fragment() {
-        // The current remote settings value uses a hash fragment for client-side
-        // routing (`grok.com/#supergrok`); we still want the referrer attached.
-        let out = ensure_query_param("https://grok.com/#supergrok", "referrer", "grok-build");
-        assert_eq!(out, "https://grok.com/?referrer=grok-build#supergrok");
-    }
-
-    #[test]
-    fn ensure_query_param_returns_unchanged_on_parse_failure() {
-        let out = ensure_query_param("not a url", "referrer", "grok-build");
-        assert_eq!(out, "not a url");
-    }
-
-    #[test]
-    fn ensure_query_param_url_encodes_value() {
-        let out = ensure_query_param("https://grok.com/supergrok", "referrer", "grok build");
-        assert_eq!(out, "https://grok.com/supergrok?referrer=grok+build");
-    }
-
     #[test]
     fn fallback_scheme_case_insensitive() {
         // Uppercase scheme that url::Url::parse rejects triggers fallback path;

crates/codegen/kigi-pager-render/src/prompt_images.rs

@@ -1879,7 +1879,7 @@ impl ScrollbackVideoRef {
 pub fn extract_video_refs(text: &str) -> Vec<ScrollbackVideoRef> {
     use std::sync::LazyLock;
 
-    // Reuse the markdown image ref pattern — video_gen uses ![prompt](path.mp4).
+    // Reuse the markdown image ref pattern — video refs use ![prompt](path.mp4).
     static MD_RE: LazyLock<regex::Regex> =
         LazyLock::new(|| regex::Regex::new(MARKDOWN_IMAGE_REF_PATTERN).unwrap());
 

crates/codegen/kigi-pager-render/src/render/osc8.rs

@@ -254,7 +254,7 @@ struct RowSegment {
 /// joiner to the *previous* row (see `BlockLine::joiner`): `None` = hard
 /// break, `Some("")` = mid-word wrap, `Some(" ")` = word wrap. Consecutive
 /// rows connected by `Some(..)` joiners are re-joined into one logical line
-/// before matching, so a long path or URL soft-wrapped across rows (imagine
+/// before matching, so a long path or URL soft-wrapped across rows (media
 /// media lives at `~/.kigi/sessions/%2F…/images/1.jpg`, which wraps in
 /// narrow panes) is detected whole and each row's fragment gets its own
 /// clickable overlay region. Spans within a row are likewise concatenated so
@@ -858,7 +858,7 @@ mod tests {
     #[test]
     fn scan_detects_grok_session_media_path() {
         // Dot-directory (`.kigi`), percent-encoded session segment, and a
-        // trailing sentence period — the shape of `image_gen` output prose.
+        // trailing sentence period — the shape of media-tool output prose.
         let line = make_line("Saved to /Users/alice/.kigi/sessions/%2Fabc/00000000/images/1.jpg.");
         let mut overlay = LinkOverlay::new();
         scan_unjoined(std::iter::once((0, &line)), 0, &[], &mut overlay);
@@ -873,7 +873,7 @@ mod tests {
 
     #[test]
     fn scan_detects_media_path_soft_wrapped_across_rows() {
-        // Regression: `image_gen` output prose wraps the long session path
+        // Regression: media-tool output prose wraps the long session path
         // across visual rows (`joiner: Some("")` mid-word break). Previously
         // each row was scanned in isolation, so only the `/Users/alice`
         // fragment on the first row matched and became clickable.