M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-shell/src/session/acp_conversion.rs

@@ -533,19 +533,6 @@ pub fn acp_tool_update(
                 )]))
                 .raw_output(raw_output_json(output, rewriter)),
         )),
-        // Dual channel: prose for non-pager clients, typed `raw_output` for the pager.
-        ToolOutput::ImageGen(_)
-        | ToolOutput::ImageToVideo(_)
-        | ToolOutput::ReferenceToVideo(_)
-        | ToolOutput::ImageEdit(_) => Some(acp::ToolCallUpdate::new(
-            acp::ToolCallId::new(Arc::from(tool_call_id)),
-            acp::ToolCallUpdateFields::new()
-                .status(Some(acp::ToolCallStatus::Completed))
-                .content(Some(vec![acp::ToolCallContent::from(
-                    acp::ContentBlock::Text(acp::TextContent::new(output.to_prompt_format())),
-                )]))
-                .raw_output(raw_output_json(output, rewriter)),
-        )),
         ToolOutput::SubagentCompleted(sub) => {
             // Text includes resume handle for discoverability + meta for TUI.
             // Shared with the chat-bidi server via `to_model_text` so both
@@ -1035,34 +1022,6 @@ mod tests {
         }
     }
 
-    #[test]
-    fn test_media_gen_acp_update_emits_prose_and_raw_output() {
-        // Dual channel: prompt-format JSON in content, typed variant in raw_output.
-        let output = ToolOutput::ImageToVideo(MediaGenOutput::new(PathBuf::from(
-            "/tmp/session/videos/3.mp4",
-        )));
-        let update = acp_tool_update(&output, "tc-1", None, None).expect("update");
-        let content = update.fields.content.expect("content");
-        let text = match &content[0] {
-            acp::ToolCallContent::Content(acp::Content {
-                content: acp::ContentBlock::Text(t),
-                ..
-            }) => t.text.clone(),
-            other => panic!("expected text content, got {other:?}"),
-        };
-        let prompt_json: serde_json::Value = serde_json::from_str(&text).expect("prompt json");
-        assert_eq!(prompt_json["path"], "/tmp/session/videos/3.mp4");
-        assert_eq!(prompt_json["filename"], "3.mp4");
-        assert_eq!(prompt_json["session_folder"], "videos");
-        assert_eq!(
-            prompt_json["message"],
-            "Video generated and saved to /tmp/session/videos/3.mp4. Do not read or re-display it, and do not describe how it appears to the user."
-        );
-        let raw = update.fields.raw_output.expect("raw_output");
-        assert_eq!(raw["type"], "ImageToVideo");
-        assert_eq!(raw["path"], "/tmp/session/videos/3.mp4");
-    }
-
     #[test]
     fn test_path_rewriter_rewrites_list_dir_raw_output() {
         let rw = PathRewriter::new(