M2 audit: excise managed connectors and xAI media-gen tools

Managed connectors (grok.com MCP admin) removed root-and-branch:
- The managed-MCP fetch/injection pipeline is gone, including the whole
  kigi-shell-session-support crate (managed-config fetch client, gateway
  tool catalog + dispatch, header injection, refresh task), reactive
  managed re-auth, mcp_doctor's grok.com-source discovery, and the
  [managed_mcps] config surface.
- TUI: the 'Managed by grok.com' section, connectors URL/deep-link,
  Action::OpenManagedConnectors, and session_team_id are gone. Local MCP
  management (list/toggle/add/remove/auth/tools) is fully intact.
- Kept as LOCAL policy: managed-settings.json MCP allow/deny enforcement,
  the multi-source local MCP merge, folder-trust gating. PluginOrigin
  Project/User labels kept (they tag locally discovered plugin dirs).

imagine/media-gen tools (xAI image/video generation) removed:
- image_gen, image_edit, video_gen, image_to_video, reference_to_video
  implementations, registrations, ToolKind/ToolInput/Output variants
  (serde-safe), config plumbing end to end, ZDR video machinery,
  /imagine + /imagine-video commands and guidance text, the bundled
  imagine skill (added to legacy cleanup so user installs delete it),
  and the media-gen render path.
- Kept: image INPUT (paste/attach, [Image #N] meta, pdf/image fetch,
  clipboard wrap), generic media-ref rendering, and the generic tool
  401-retry machinery (tests renamed, assertions unweakened).
- deploy_app stays: it is a permanently-disabled local stub deploying
  nowhere.

121 files changed, 8 deleted. Gates: workspace check/clippy 0/0, fmt,
deny ok; suites green (tools 2554, shell 4862, tui 6608, workspace
1042). Remaining grok.com strings live only in the auth-method ids and
changelog archives (§9/M3 sweep).

crates/codegen/kigi-workspace/src/capability.rs

@@ -94,10 +94,6 @@ pub(crate) const ALL_TOOL_KINDS: &[ToolKind] = &[
     ToolKind::EnterPlan,
     ToolKind::ExitPlan,
     ToolKind::AskUser,
-    ToolKind::ImageGen,
-    ToolKind::VideoGen,
-    ToolKind::ImageToVideo,
-    ToolKind::ReferenceToVideo,
     ToolKind::DeployApp,
     ToolKind::SearchTool,
     ToolKind::UseTool,
@@ -143,8 +139,7 @@ pub(crate) fn kind_allowed(mode: CapabilityMode, kind: ToolKind) -> bool {
         Lsp | ListDir | List => matches!(mode, M::ReadOnly | M::ReadWrite | M::Execute),
 
         // Edit class.
-        Edit | Write | Delete | Move | ImageGen | VideoGen | ImageToVideo | ReferenceToVideo
-        | DeployApp => matches!(mode, M::ReadWrite),
+        Edit | Write | Delete | Move | DeployApp => matches!(mode, M::ReadWrite),
 
         // Bash / shell.
         Execute => matches!(mode, M::Execute),

crates/codegen/kigi-workspace/src/session/tool_config.rs

@@ -294,10 +294,6 @@ impl SessionContextFactory for WorkspaceSessionContextFactory {
             web_search_config: kigi_tools::implementations::web_search::WebSearchConfig::default(),
             web_fetch_config: build_web_fetch_config(),
             lsp: None,
-            image_gen_config:
-                kigi_tools::implementations::grok_build::image_gen::ImageGenConfig::default(),
-            video_gen_config:
-                kigi_tools::implementations::grok_build::video_gen::VideoGenConfig::default(),
             app_builder_deployer_config:
                 kigi_tools::implementations::grok_build::deploy_app::AppBuilderDeployerConfig::default(),
             api_key_provider: None,
@@ -389,8 +385,6 @@ pub mod test_support {
                 web_search_config: Default::default(),
                 web_fetch_config: Default::default(),
                 lsp: None,
-                image_gen_config: Default::default(),
-                video_gen_config: Default::default(),
                 app_builder_deployer_config: Default::default(),
                 api_key_provider: None,
                 attribution_callback: None,