§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/src/session/acp_session_impl/goal.rs

@@ -22,7 +22,7 @@ impl RoleCapability {
     /// `can_execute` for terminal/bash).
     fn is_satisfied(
         self,
-        summary: &kigi_tools::implementations::grok_build::task::types::SubagentTypeSummary,
+        summary: &kigi_tools::implementations::kigi::task::types::SubagentTypeSummary,
     ) -> bool {
         match self {
             Self::Skeptic => summary.can_read && summary.can_search,
@@ -42,7 +42,7 @@ pub(crate) struct PanelResolveCache {
     /// result for the role's `general-purpose` toolset on that harness).
     describe: std::collections::HashMap<
         String,
-        kigi_tools::implementations::grok_build::task::types::SubagentDescribeOutcome,
+        kigi_tools::implementations::kigi::task::types::SubagentDescribeOutcome,
     >,
 }
 
@@ -57,7 +57,7 @@ fn role_tool_names_from(
     cache: &PanelResolveCache,
     inherit: &crate::session::goal_role_tools::RoleToolNames,
 ) -> crate::session::goal_role_tools::RoleToolNames {
-    use kigi_tools::implementations::grok_build::task::types::SubagentDescribeOutcome;
+    use kigi_tools::implementations::kigi::task::types::SubagentDescribeOutcome;
     // `override_.agent_type` is the committed harness; the cache is keyed on it.
     match override_.agent_type.as_deref() {
         Some(harness) => match cache.describe.get(harness) {
@@ -115,9 +115,9 @@ impl SessionActor {
         &self,
         current_tokens: i64,
         purpose: DrainPurpose,
-        extra: Vec<kigi_tools::implementations::grok_build::update_goal::UpdateGoalEnvelope>,
+        extra: Vec<kigi_tools::implementations::kigi::update_goal::UpdateGoalEnvelope>,
     ) {
-        use kigi_tools::implementations::grok_build::update_goal::{RejectReason, UpdateGoalAck};
+        use kigi_tools::implementations::kigi::update_goal::{RejectReason, UpdateGoalAck};
         // The `update_goal` tool and its `GoalUpdateHandle` are always
         // registered (see `spawn_session_actor`), so a model can call
         // `update_goal` in a session that never entered goal mode — e.g. any
@@ -650,10 +650,10 @@ impl SessionActor {
         attempt: u32,
         outcome: crate::session::goal_classifier::GoalClassifierOutcome,
         notify: &crate::session::goal_orchestrator::GoalNotifySender,
-    ) -> kigi_tools::implementations::grok_build::update_goal::UpdateGoalAck {
+    ) -> kigi_tools::implementations::kigi::update_goal::UpdateGoalAck {
         use crate::session::goal_classifier::GoalClassifierOutcome;
         use crate::session::goal_tracker::GoalClassifierVerdict;
-        use kigi_tools::implementations::grok_build::update_goal::UpdateGoalAck;
+        use kigi_tools::implementations::kigi::update_goal::UpdateGoalAck;
 
         let current_tokens = self.chat_state_handle.get_total_tokens().await as i64;
         let (tokens_used, finished_marginal) = self.goal_tokens(current_tokens);
@@ -1299,7 +1299,7 @@ impl SessionActor {
         choice: &crate::agent::config::GoalRoleModelChoice,
         capability: RoleCapability,
         event_tx: &tokio::sync::mpsc::UnboundedSender<
-            kigi_tools::implementations::grok_build::task::types::SubagentEvent,
+            kigi_tools::implementations::kigi::task::types::SubagentEvent,
         >,
     ) -> (
         crate::session::goal_planner::RoleSpawnOverride,
@@ -1372,17 +1372,15 @@ impl SessionActor {
         pair: &crate::util::config::GoalRoleModel,
         capability: RoleCapability,
         event_tx: &tokio::sync::mpsc::UnboundedSender<
-            kigi_tools::implementations::grok_build::task::types::SubagentEvent,
+            kigi_tools::implementations::kigi::task::types::SubagentEvent,
         >,
         available_models: &indexmap::IndexMap<String, crate::agent::config::ModelEntry>,
         cache: &mut PanelResolveCache,
     ) -> crate::session::goal_planner::RoleSpawnOverride {
         use crate::session::events::{Event, GoalRoleModelFailOpenReason as Reason};
         use crate::session::goal_planner::RoleSpawnOverride;
-        use kigi_tools::implementations::grok_build::task::backend::{
-            ChannelBackend, SubagentBackend,
-        };
-        use kigi_tools::implementations::grok_build::task::types::SubagentDescribeOutcome;
+        use kigi_tools::implementations::kigi::task::backend::{ChannelBackend, SubagentBackend};
+        use kigi_tools::implementations::kigi::task::types::SubagentDescribeOutcome;
 
         let fail_open = |reason: Reason| {
             self.emit_event(Event::GoalRoleModelFailOpen {
@@ -1408,7 +1406,7 @@ impl SessionActor {
         }
         // 2b. Reject a STRICT harness whose flavor isn't representable (e.g.
         //    `codex`): it resolves, but `resolve_subagent_toolset` would
-        //    silently run grok-build flavor. Non-strict names (grok-build
+        //    silently run kigi flavor. Non-strict names (kigi
         //    family) run the default flavor and pass; unresolvable names fall
         //    through to the describe `Unknown` arm below.
         if kigi_agent::config::is_strict_harness_agent_type(&pair.agent_type)
@@ -1511,9 +1509,9 @@ impl SessionActor {
     /// toolset; [`RoleToolNames::from_parent`] applies the literal fallback for
     /// any kind the bridge lacks, and resolves `{WRITE_TOOL}` from the parent
     /// `Edit` tool when the bridge has no `Write` (so the inherit / retry render
-    /// agrees with `from_summary` — `search_replace` on the default grok-build
+    /// agrees with `from_summary` — `search_replace` on the default kigi
     /// host, not the literal `write`). The `{TOOLSET_TOOLS}` block is empty on
-    /// this path (no per-role toolset enumeration); on the default grok-build
+    /// this path (no per-role toolset enumeration); on the default kigi
     /// host the bridge resolves the parent's real tool ids (`read_file`, …).
     pub(crate) async fn resolve_inherit_role_tool_names(
         &self,
@@ -2340,7 +2338,7 @@ impl SessionActor {
 #[cfg(test)]
 mod role_capability_tests {
     use super::RoleCapability;
-    use kigi_tools::implementations::grok_build::task::types::SubagentTypeSummary;
+    use kigi_tools::implementations::kigi::task::types::SubagentTypeSummary;
 
     fn summary(can_read: bool, can_search: bool, can_execute: bool) -> SubagentTypeSummary {
         SubagentTypeSummary {
@@ -2371,7 +2369,7 @@ mod role_tool_names_tests {
     use super::{PanelResolveCache, role_tool_names_from};
     use crate::session::goal_planner::RoleSpawnOverride;
     use crate::session::goal_role_tools::RoleToolNames;
-    use kigi_tools::implementations::grok_build::task::types::{
+    use kigi_tools::implementations::kigi::task::types::{
         SubagentDescribeOutcome, SubagentTypeSummary,
     };
     use kigi_tools::types::tool::ToolKind;