§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/src/session/acp_mcp.rs

@@ -1,14 +1,14 @@
-//! In-process SDK MCP servers over the ACP reverse channel (`x.ai/mcp/sdk_call`).
+//! In-process SDK MCP servers over the ACP reverse channel (`kigi/mcp/sdk_call`).
 //!
-//! The official `grok-agent-sdk` lets a host define in-process tools (`@tool` /
+//! The official `kigi-agent-sdk` lets a host define in-process tools (`@tool` /
 //! `create_sdk_mcp_server`). When `transport="acp"`, the SDK registers them in
-//! `session/new` `_meta["x.ai/mcp/servers"] = [{ "name", "serverId" }]` and the agent
+//! `session/new` `_meta["kigi/mcp/servers"] = [{ "name", "serverId" }]` and the agent
 //! invokes their tools by sending each MCP JSON-RPC message back to the client as a
-//! reverse `x.ai/mcp/sdk_call` request — handled here by [`GatewayAcpInvoker`].
+//! reverse `kigi/mcp/sdk_call` request — handled here by [`GatewayAcpInvoker`].
 //!
-//! NOTE: the *reverse* route (agent -> client, `x.ai/mcp/sdk_call`) invokes a tool that
+//! NOTE: the *reverse* route (agent -> client, `kigi/mcp/sdk_call`) invokes a tool that
 //! lives in the SDK's process. It is the zero-IPC mirror of the *forward* route (client
-//! -> agent, `x.ai/mcp/call` in `extensions::mcp`), which invokes a tool on a server the
+//! -> agent, `kigi/mcp/call` in `extensions::mcp`), which invokes a tool on a server the
 //! AGENT is connected to. They use distinct method strings and sit on opposite request
 //! handlers, so they never collide.
 
@@ -20,7 +20,7 @@ use kigi_mcp::acp_transport::AcpReverseInvoker;
 use kigi_mcp::servers::AcpServerEntry;
 use kigi_mcp::wire;
 
-/// Parse `_meta["x.ai/mcp/servers"]` into [`AcpServerEntry`] registrations. Each entry
+/// Parse `_meta["kigi/mcp/servers"]` into [`AcpServerEntry`] registrations. Each entry
 /// is deserialized directly into the canonical type (so the `serverId` wire field is
 /// serde-checked, not hand-read); entries missing `name`/`serverId` are skipped with a
 /// warning. A name seen twice keeps the first (server names are the tool namespace, so a
@@ -38,12 +38,12 @@ pub fn parse_acp_mcp_servers(meta: Option<&acp::Meta>) -> Vec<AcpServerEntry> {
         let server: AcpServerEntry = match serde_json::from_value(entry.clone()) {
             Ok(server) => server,
             Err(err) => {
-                tracing::warn!(entry = %entry, %err, "ignoring malformed x.ai/mcp/servers entry");
+                tracing::warn!(entry = %entry, %err, "ignoring malformed kigi/mcp/servers entry");
                 continue;
             }
         };
         if !seen.insert(server.name.clone()) {
-            tracing::warn!(name = %server.name, "ignoring duplicate x.ai/mcp/servers entry");
+            tracing::warn!(name = %server.name, "ignoring duplicate kigi/mcp/servers entry");
             continue;
         }
         servers.push(server);
@@ -53,7 +53,7 @@ pub fn parse_acp_mcp_servers(meta: Option<&acp::Meta>) -> Vec<AcpServerEntry> {
 
 /// Reverse-RPC invoker for in-process SDK MCP servers.
 ///
-/// Each [`invoke`](AcpReverseInvoker::invoke) sends one `x.ai/mcp/sdk_call` reverse request
+/// Each [`invoke`](AcpReverseInvoker::invoke) sends one `kigi/mcp/sdk_call` reverse request
 /// straight through the gateway. `AcpAgentGatewaySender::send` returns a `Send` future
 /// (unlike the `?Send` `acp::Client::ext_method` trait method), so the rmcp transport's
 /// `Send` invoker bound is satisfied with no relay task. Calls are independent and may
@@ -68,7 +68,7 @@ impl GatewayAcpInvoker {
     }
 }
 
-/// Reverse `x.ai/mcp/sdk_call` params. Declares the on-wire field names once (mirrors
+/// Reverse `kigi/mcp/sdk_call` params. Declares the on-wire field names once (mirrors
 /// the forward side's typed `McpCallRequest`) so the `serverId` literal isn't hand-spelled.
 #[derive(serde::Serialize)]
 struct SdkCallParams<'a> {
@@ -111,7 +111,7 @@ mod tests {
     #[test]
     fn parses_valid_entries_and_skips_malformed() {
         let meta = serde_json::json!({
-            "x.ai/mcp/servers": [
+            "kigi/mcp/servers": [
                 { "name": "harness-tools", "serverId": "srv_0" },
                 { "name": "missing-id" },
                 { "serverId": "no_name" },
@@ -126,7 +126,7 @@ mod tests {
     #[test]
     fn duplicate_names_keep_the_first() {
         let meta = serde_json::json!({
-            "x.ai/mcp/servers": [
+            "kigi/mcp/servers": [
                 { "name": "tools", "serverId": "srv_0" },
                 { "name": "tools", "serverId": "srv_1" },
             ]