M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-shell/src/agent/subagent/handle_request.rs

@@ -1054,9 +1054,6 @@ pub(crate) async fn handle_subagent_request(
                 ctx.memory_config.clone()
             },
             Default::default(),
-            ctx.managed_mcp_state.clone(),
-            None,
-            ctx.managed_mcp_proxy_base_url.clone(),
             effective_model_id,
             ctx.yolo_mode
                 || matches!(
@@ -1069,8 +1066,6 @@ pub(crate) async fn handle_subagent_request(
             None,
             ctx.web_search_config.clone(),
             ctx.web_fetch_config.clone(),
-            ctx.image_gen_config.clone(),
-            ctx.video_gen_config.clone(),
             ctx.app_builder_deployer_config.clone(),
             ctx.write_file_enabled,
             ctx.goal_enabled,

crates/codegen/kigi-shell/src/agent/subagent/mod.rs

@@ -144,7 +144,6 @@ pub(crate) struct SubagentSpawnContext {
     /// context is built (an async snapshot from the parent session actor).
     pub client_hooks: crate::extensions::hooks::ClientHooks,
     pub sampling_config: kigi_sampler::SamplerConfig,
-    pub managed_mcp_proxy_base_url: String,
     /// The staging auth header value propagated from the parent. Used
     /// when materialising subagent `SamplerConfig`s for auth-flow tracking
     /// and for `inject_url_derived_headers` in the construction helpers.
@@ -209,10 +208,6 @@ pub(crate) struct SubagentSpawnContext {
     pub web_search_config: kigi_tools::implementations::WebSearchConfig,
     /// Resolved config for web fetch.
     pub web_fetch_config: kigi_tools::implementations::grok_build::web_fetch::WebFetchConfig,
-    /// Image generation config (parent-inherited).
-    pub image_gen_config: kigi_tools::implementations::grok_build::image_gen::ImageGenConfig,
-    /// Resolved config for video generation.
-    pub video_gen_config: kigi_tools::implementations::grok_build::video_gen::VideoGenConfig,
     /// Resolved config for the deploy service.
     pub app_builder_deployer_config:
         kigi_tools::implementations::grok_build::deploy_app::AppBuilderDeployerConfig,
@@ -320,8 +315,6 @@ pub(crate) struct SubagentSpawnContext {
     /// time). Servers added later via `UpdateMcpServers` (managed MCPs, plugin reload)
     /// will not appear here. Named references only resolve against the initial config.
     pub parent_mcp_configs: Vec<agent_client_protocol::McpServer>,
-    /// Parent's managed MCP state handle (Arc-shared, no re-fetch).
-    pub managed_mcp_state: crate::session::managed_mcp::ManagedMcpStateHandle,
     /// Snapshot of the parent session's MCP client pool at spawn time.
     pub parent_mcp_pool: Option<crate::session::mcp_servers::SharedMcpPool>,
     /// Snapshot of the parent session's resolved tool schema at spawn time.

crates/codegen/kigi-shell/src/agent/subagent/tests/mod.rs

@@ -143,16 +143,6 @@ fn subagent_inherits_parent_lsp_via_context() {
     );
 }
 #[test]
-fn subagent_inherits_managed_mcp_state_via_context() {
-    let handle = crate::session::managed_mcp::ManagedMcpStateHandle::default();
-    let mut ctx = ctx_with_toggle(HashMap::new());
-    ctx.managed_mcp_state = handle.clone();
-    assert!(
-        Arc::ptr_eq(& handle, & ctx.managed_mcp_state),
-        "child should share parent's managed MCP state (Arc identity)"
-    );
-}
-#[test]
 fn no_parent_lsp_means_child_gets_none() {
     let ctx = ctx_with_toggle(HashMap::new());
     assert!(ctx.lsp.is_none());
@@ -1110,7 +1100,6 @@ fn dummy_tracker(
         permission_handle: kigi_workspace::permission::PermissionHandle::allow_all(),
         attribution_callback: None,
         agent_name: "grok-build".to_string(),
-        managed_mcp_proxy_base_url: String::new(),
         session_default_agent_profile: None,
         allowed_subagent_types: None,
         hook_registry: None,