§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/src/managed_config.rs

@@ -116,7 +116,7 @@ fn try_lock_managed_config(home: &std::path::Path) -> Option<std::fs::File> {
 /// Retry budget for a sync, pairing the attempt count with a wall-clock cap.
 #[derive(Clone, Copy)]
 enum SyncBudget {
-    /// Background loop and explicit `grok setup`; runs retries to completion.
+    /// Background loop and explicit `kigi setup`; runs retries to completion.
     Standard,
     /// Post-login sync; capped because login latency is user-visible.
     Login,
@@ -343,7 +343,7 @@ pub(crate) fn spawn_sync(cancel: tokio_util::sync::CancellationToken) {
 }
 
 /// Deployment id reported for `deployment_key` on chat requests, credential
-/// snapshots, and OTel: the **server** GrokBuildDeployment UUID (the id
+/// snapshots, and OTel: the **server** KigiDeployment UUID (the id
 /// server-side dashboards filter on) when the managed-config sync marker was
 /// written by this same key (fingerprint match), else UUIDv5 of the key.
 /// `None` key (team/OAuth) → `None`, never a stale marker value.
@@ -380,7 +380,7 @@ fn deployment_key_fingerprint(key: &str) -> String {
 }
 
 /// Whether managed config fetching is enabled (env > config.toml > default true).
-/// Callers doing auto-fetch should check this; explicit user actions (grok setup) skip it.
+/// Callers doing auto-fetch should check this; explicit user actions (kigi setup) skip it.
 pub fn is_fetch_enabled() -> bool {
     if let Some(v) = crate::agent::config::env_bool("KIGI_MANAGED_CONFIG") {
         return v;
@@ -401,7 +401,7 @@ struct SyncOutcome {
     wrote: bool,
     /// The server returned non-empty config for the consulted principal — true
     /// even when a concurrent writer held the lock and our write was skipped, so
-    /// `grok setup` doesn't misreport a lock skip as "no config".
+    /// `kigi setup` doesn't misreport a lock skip as "no config".
     served: bool,
     /// Which credential was consulted, so callers word team-vs-deployment
     /// messages by what actually served, not just what's configured.
@@ -483,7 +483,7 @@ enum FetchedConfig {
 
 /// Fetches the configuration for the current principal without touching disk:
 /// the deployment key first, then a signed-in team. The installing sync and the
-/// read-only `grok setup --json` both build on this.
+/// read-only `kigi setup --json` both build on this.
 async fn fetch_for_principal(budget: SyncBudget) -> Result<FetchedConfig, ManagedConfigError> {
     let max_attempts = budget.max_attempts();
     // Resolve from the merged config (managed_config_url override) so endpoint
@@ -690,7 +690,7 @@ pub async fn post_login_sync(_authenticated: Option<KimiAuth>) -> ManagedConfigS
     }
 }
 
-/// Whether a credential exists that `grok setup` could install config for.
+/// Whether a credential exists that `kigi setup` could install config for.
 pub fn has_principal() -> bool {
     resolve_deployment_key().is_some()
 }
@@ -770,7 +770,7 @@ network access: reconnect and start again. If you can't reconnect, contact your
 /// policy can't be established gets no unmanaged session. With no signing key it reads the user-writable
 /// marker (a local user can disarm it by editing one field); non-forgeable enforcement is the trust-rooted
 /// layers (root-owned path, MDM, signed cache). No client env disables it; recovery stays open (reconnect /
-/// `grok setup`); ceasing to serve `fail_closed` rolls back.
+/// `kigi setup`); ceasing to serve `fail_closed` rolls back.
 pub fn managed_policy_gate() -> Result<(), String> {
     // Skip under the lib unit-test build only: `bootstrap` reaches this without a staged
     // `KIGI_SHARE_DIR` and would flake on the dev machine's real marker/auth. The pure decision
@@ -824,7 +824,7 @@ fn managed_policy_gate_decision(
     Ok(())
 }
 
-/// Outcome of the `grok setup` sync. The caller renders it — CLI presentation
+/// Outcome of the `kigi setup` sync. The caller renders it — CLI presentation
 /// and exit codes stay out of the library.
 #[derive(Debug)]
 pub enum SetupOutcome {
@@ -836,9 +836,9 @@ pub enum SetupOutcome {
     Failed(ManagedConfigError),
 }
 
-/// Result of `grok setup --json`: what the server serves for the current
+/// Result of `kigi setup --json`: what the server serves for the current
 /// principal, verbatim. `managed_config` may embed the enforced deployment key,
-/// exactly as `grok setup` would write it to disk.
+/// exactly as `kigi setup` would write it to disk.
 #[derive(Debug, serde::Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SetupReport {
@@ -849,20 +849,20 @@ pub struct SetupReport {
     pub configured: bool,
     pub deployment_id: Option<String>,
     pub team_id: Option<String>,
-    /// TOML documents exactly as `grok setup` would install them.
+    /// TOML documents exactly as `kigi setup` would install them.
     pub managed_config: Option<String>,
     pub requirements: Option<String>,
     pub fail_closed: bool,
 }
 
-/// Fetches the report behind `grok setup --json` without writing anything:
+/// Fetches the report behind `kigi setup --json` without writing anything:
 /// no artifacts, no signature sidecar, no sync marker.
 pub async fn fetch_setup_report() -> Result<SetupReport, ManagedConfigError> {
     let (source, body) = match fetch_for_principal(SyncBudget::Standard).await? {
         FetchedConfig::DeploymentKey { body, .. } => (Some("deploymentKey"), body),
         FetchedConfig::NoPrincipal => (None, ManagedConfigResponse::default()),
     };
-    // Match the installer's trust decision: a payload `grok setup` would refuse
+    // Match the installer's trust decision: a payload `kigi setup` would refuse
     // is reported as an error, not printed as installable config.
     if source.is_some()
         && kigi_config::signed_policy::verification_active()
@@ -882,7 +882,7 @@ pub async fn fetch_setup_report() -> Result<SetupReport, ManagedConfigError> {
     })
 }
 
-/// Run the `grok setup` sync for the current principal. The caller must check
+/// Run the `kigi setup` sync for the current principal. The caller must check
 /// [`has_principal`] first and render the no-principal guidance.
 pub async fn run_setup() -> SetupOutcome {
     match sync_with_budget(SyncBudget::Standard).await {