M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-shell/src/session/agent_rebuild.rs

@@ -46,11 +46,9 @@ use kigi_agent::{Agent, AgentBuilder, CompactionPolicy, ReminderPolicy};
 use kigi_tools::computer::types::{AsyncFileSystem, TerminalBackend};
 use kigi_tools::implementations::grok_build::ask_user_question::types::UserQuestionRequest;
 use kigi_tools::implementations::grok_build::deploy_app::AppBuilderDeployerConfig;
-use kigi_tools::implementations::grok_build::image_gen::ImageGenConfig;
 use kigi_tools::implementations::grok_build::task::types::{
     MonitorEventBuffer, SubagentEvent, TaskModelValidator,
 };
-use kigi_tools::implementations::grok_build::video_gen::VideoGenConfig;
 use kigi_tools::implementations::grok_build::web_fetch::WebFetchConfig;
 use kigi_tools::implementations::lsp::LspBackend;
 use kigi_tools::implementations::web_search::WebSearchConfig;
@@ -95,8 +93,6 @@ pub(crate) struct AgentRebuildSpec {
     pub web_search_config: WebSearchConfig,
     pub backend_search: bool,
     pub web_fetch_config: WebFetchConfig,
-    pub image_gen_config: ImageGenConfig,
-    pub video_gen_config: VideoGenConfig,
     pub app_builder_deployer_config: AppBuilderDeployerConfig,
     pub write_file_enabled: bool,
     pub subagents_enabled: bool,
@@ -125,7 +121,6 @@ pub(crate) struct AgentRebuildSpec {
     pub respect_gitignore: bool,
     pub path_not_found_hints: bool,
     pub mcp_state: Arc<tokio::sync::Mutex<crate::session::mcp_servers::McpState>>,
-    pub managed_gateway_tool_client: Option<kigi_tools::types::resources::ManagedGatewayToolClient>,
     pub is_non_interactive: bool,
     pub system_prompt_label: String,
     pub owner_session_id: Option<String>,
@@ -190,8 +185,6 @@ impl AgentRebuildSpec {
             web_search_config,
             backend_search,
             web_fetch_config,
-            image_gen_config,
-            video_gen_config,
             app_builder_deployer_config,
             write_file_enabled,
             subagents_enabled,
@@ -218,7 +211,6 @@ impl AgentRebuildSpec {
             respect_gitignore,
             path_not_found_hints,
             mcp_state,
-            managed_gateway_tool_client,
             is_non_interactive,
             system_prompt_label,
             owner_session_id,
@@ -244,8 +236,6 @@ impl AgentRebuildSpec {
         .with_state_path(bridge_state_path.clone())
         .with_web_search_config(web_search_config.clone())
         .with_backend_search(*backend_search)
-        .with_image_gen_config(image_gen_config.clone())
-        .with_video_gen_config(video_gen_config.clone())
         .with_app_builder_deployer_config(app_builder_deployer_config.clone())
         .with_web_fetch_config(web_fetch_config.clone())
         .with_write_file_enabled(*write_file_enabled)
@@ -351,9 +341,6 @@ impl AgentRebuildSpec {
                 *path_not_found_hints,
             ))
             .await;
-        if let Some(client) = managed_gateway_tool_client.clone() {
-            agent.tool_bridge().update_resource(client).await;
-        }
         {
             use kigi_tools::implementations::grok_build::ask_user_question::UserQuestionSender;
             agent
@@ -392,8 +379,6 @@ pub(crate) fn test_rebuild_spec_default() -> Arc<AgentRebuildSpec> {
         web_search_config: WebSearchConfig::default(),
         backend_search: false,
         web_fetch_config: WebFetchConfig::Disabled,
-        image_gen_config: ImageGenConfig::default(),
-        video_gen_config: VideoGenConfig::default(),
         app_builder_deployer_config: AppBuilderDeployerConfig::default(),
         write_file_enabled: true,
         subagents_enabled: false,
@@ -422,7 +407,6 @@ pub(crate) fn test_rebuild_spec_default() -> Arc<AgentRebuildSpec> {
         mcp_state: Arc::new(tokio::sync::Mutex::new(
             crate::session::mcp_servers::McpState::new(vec![]),
         )),
-        managed_gateway_tool_client: None,
         is_non_interactive: false,
         system_prompt_label: kigi_agent::DEFAULT_SYSTEM_PROMPT_LABEL.to_string(),
         owner_session_id: Some("test-session".to_string()),