§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-shell/tests/test_leader_version_skew.rs

@@ -5,14 +5,14 @@
 //! Binaries are resolved per role:
 //! - `KIGI_BINARY_LEADER` — the binary that elects the initial leader
 //!   (typically the latest released stable, e.g. fetched from
-//!   `https://storage.googleapis.com/grok-build-public-artifacts/cli/grok-<ver>-linux-x86_64`).
+//!   `https://storage.googleapis.com/kigi-public-artifacts/cli/kigi-<ver>-linux-x86_64`).
 //! - `KIGI_BINARY_CLIENT` — the second client (typically a freshly built main).
 //!
 //! All tests are `#[ignore]`d: they need two pre-built binaries and spawn real
 //! leader subprocesses. On-demand today — no CI lane runs them; invoke with:
 //!
 //! ```bash
-//! KIGI_BINARY_LEADER=/path/to/grok-old KIGI_BINARY_CLIENT=/path/to/grok-new \
+//! KIGI_BINARY_LEADER=/path/to/kigi-old KIGI_BINARY_CLIENT=/path/to/kigi-new \
 //!   cargo test -p kigi-shell --test test_leader_version_skew -- --ignored --nocapture
 //! ```
 
@@ -202,7 +202,7 @@ async fn old_client_adopts_new_leader_and_still_functions() {
                 .expect("old client prompt on new leader failed");
 
             // The leader records the client/leader version mismatch (the
-            // x.ai/leader/version_mismatch notification's server-side warn).
+            // kigi/leader/version_mismatch notification's server-side warn).
             let deadline = tokio::time::Instant::now() + Duration::from_secs(10);
             let mut saw_mismatch = false;
             while tokio::time::Instant::now() < deadline {
@@ -221,7 +221,7 @@ async fn old_client_adopts_new_leader_and_still_functions() {
         .await;
 }
 
-/// `grok update`'s relaunch signal against a REAL old leader: connect,
+/// `kigi update`'s relaunch signal against a REAL old leader: connect,
 /// require `relaunch_v1`, send `RelaunchForUpdate`, and the leader exits so
 /// the surviving client re-elects. Mirrors the private
 /// `signal_leaders_to_relaunch` in `kigi-bin/src/main.rs` (which is
@@ -260,7 +260,7 @@ async fn relaunch_for_update_drives_real_old_leader_to_exit() {
             // The update-signal body, against the sandboxed socket.
             let control = LeaderClient::connect(
                 home.path().join(".kigi").join("leader.sock"),
-                "grok-pager-update",
+                "kigi-pager-update",
                 ClientMode::Stdio,
                 ClientCapabilities::default(),
             )