§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/src/agent/subagent/handle_request.rs

@@ -15,7 +15,7 @@ use crate::session::{
 use crate::terminal::AsyncTerminalRunner;
 use crate::tools::ToolContext;
 use kigi_acp_lib::AcpAgentGatewaySender as GatewaySender;
-use kigi_tools::implementations::grok_build::task::types::*;
+use kigi_tools::implementations::kigi::task::types::*;
 use kigi_workspace::file_system::AsyncFileSystem;
 use kigi_hunk_tracker::HunkTrackerHandle;
 use super::*;
@@ -306,7 +306,7 @@ pub(crate) async fn handle_subagent_request(
                     subagent_id = % request.id, error = % e,
                     "Could not resolve worktree base dir, using temp dir for subagent worktree"
                 );
-                std::env::temp_dir().join("grok-subagent-worktrees").join(&request.id)
+                std::env::temp_dir().join("kigi-subagent-worktrees").join(&request.id)
             }
         };
         let source_clone = source_cwd;
@@ -396,7 +396,7 @@ pub(crate) async fn handle_subagent_request(
         );
     }
     {
-        use kigi_tools::implementations::grok_build::task::MAX_SUBAGENT_DEPTH;
+        use kigi_tools::implementations::kigi::task::MAX_SUBAGENT_DEPTH;
         use kigi_tools::types::tool::ToolKind;
         let child_depth = ctx.parent_depth + 1;
         if child_depth >= MAX_SUBAGENT_DEPTH {
@@ -754,10 +754,10 @@ pub(crate) async fn handle_subagent_request(
         }
     }
     if let Some(scope) = agent_memory_scope {
-        use kigi_tools::implementations::grok_build;
+        use kigi_tools::implementations::kigi;
         use kigi_tools::implementations::opencode;
         let memory_tools: Vec<kigi_tools::registry::types::ToolConfig> = vec![
-            (& grok_build::ReadFileTool).into(), (& grok_build::SearchReplaceTool)
+            (& kigi::ReadFileTool).into(), (& kigi::SearchReplaceTool)
             .into(), (& opencode::OpenCodeWriteTool).into(),
         ];
         for tc in memory_tools {
@@ -1570,7 +1570,7 @@ pub(crate) async fn handle_subagent_request(
     let mut worktree_removed = false;
     if let Some(ref wt_path) = worktree_path {
         if snapshot_dispose_enabled {
-            let ref_name = format!("refs/grok/subagents/{}", request.id);
+            let ref_name = format!("refs/kigi/subagents/{}", request.id);
             let source_repo = resolve_subagent_source_repo(&ctx);
             match crate::session::worktree::snapshot_subagent_worktree(
                     wt_path,