§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-tools-api/src/config_validation.rs

@@ -138,12 +138,12 @@ mod tests {
 
     #[test]
     fn unset_params_is_ok_none() {
-        assert_eq!(parse_params_json(0, "GrokBuild:grep", None), Ok(None));
+        assert_eq!(parse_params_json(0, "Kigi:grep", None), Ok(None));
     }
 
     #[test]
     fn valid_object_is_returned() {
-        let parsed = parse_params_json(0, "GrokBuild:grep", Some(r#"{"max_results":50}"#)).unwrap();
+        let parsed = parse_params_json(0, "Kigi:grep", Some(r#"{"max_results":50}"#)).unwrap();
         assert_eq!(
             parsed,
             Some(
@@ -157,7 +157,7 @@ mod tests {
 
     #[test]
     fn empty_string_is_a_parse_error() {
-        let err = parse_params_json(3, "GrokBuild:grep", Some("")).unwrap_err();
+        let err = parse_params_json(3, "Kigi:grep", Some("")).unwrap_err();
         assert_eq!(err.index, 3);
         assert_eq!(err.field_path(), "tools[3].params_json");
         assert!(matches!(
@@ -188,10 +188,10 @@ mod tests {
 
     #[test]
     fn name_override_unset_or_valid_is_ok() {
-        assert_eq!(validate_name_override(0, "GrokBuild:grep", None), Ok(()));
-        for name in ["search", "GrokBuild:grep", "a-b_C9"] {
+        assert_eq!(validate_name_override(0, "Kigi:grep", None), Ok(()));
+        for name in ["search", "Kigi:grep", "a-b_C9"] {
             assert_eq!(
-                validate_name_override(0, "GrokBuild:grep", Some(name)),
+                validate_name_override(0, "Kigi:grep", Some(name)),
                 Ok(()),
                 "name={name:?}"
             );
@@ -201,7 +201,7 @@ mod tests {
     #[test]
     fn name_override_outside_charset_is_rejected() {
         for name in ["has space", "", "a:b:c", "dot.name"] {
-            let err = validate_name_override(2, "GrokBuild:grep", Some(name)).unwrap_err();
+            let err = validate_name_override(2, "Kigi:grep", Some(name)).unwrap_err();
             assert_eq!(err.index, 2, "name={name:?}");
             assert_eq!(err.field_path(), "tools[2].name_override");
             assert!(
@@ -228,30 +228,27 @@ mod tests {
 
     #[test]
     fn all_ids_present_returns_none() {
-        let entries = [entry("GrokBuild:grep"), entry("GrokBuild:read_file")];
-        let allowed = allowed(&["GrokBuild:grep", "GrokBuild:read_file", "GrokBuild:bash"]);
+        let entries = [entry("Kigi:grep"), entry("Kigi:read_file")];
+        let allowed = allowed(&["Kigi:grep", "Kigi:read_file", "Kigi:bash"]);
         assert_eq!(first_unknown_tool_id(&entries, &allowed), None);
     }
 
     #[test]
     fn empty_entries_returns_none() {
-        assert_eq!(
-            first_unknown_tool_id(&[], &allowed(&["GrokBuild:grep"])),
-            None
-        );
+        assert_eq!(first_unknown_tool_id(&[], &allowed(&["Kigi:grep"])), None);
     }
 
     #[test]
     fn first_unknown_id_is_returned_with_index() {
         let entries = [
-            entry("GrokBuild:grep"),
-            entry("GrokBuild:nonexistent"),
-            entry("GrokBuild:also_missing"),
+            entry("Kigi:grep"),
+            entry("Kigi:nonexistent"),
+            entry("Kigi:also_missing"),
         ];
-        let allowed = allowed(&["GrokBuild:grep"]);
+        let allowed = allowed(&["Kigi:grep"]);
         assert_eq!(
             first_unknown_tool_id(&entries, &allowed),
-            Some((1, "GrokBuild:nonexistent"))
+            Some((1, "Kigi:nonexistent"))
         );
     }
 }

crates/codegen/kigi-tools-api/src/lib.rs

@@ -1,4 +1,4 @@
-//! Shared API definitions for Grok tools: protobuf types, config validation,
+//! Shared API definitions for Kigi tools: protobuf types, config validation,
 //! and canonical slash-command wording.
 //!
 //! Used by both the tools library and the gRPC server, and by host services
@@ -96,7 +96,7 @@ pub use pb::{
 
 /// Default client-facing tool name derived from a namespaced tool id.
 ///
-/// Tool ids are colon-separated `Namespace:tool` (e.g. `GrokBuild:grep`); the
+/// Tool ids are colon-separated `Namespace:tool` (e.g. `Kigi:grep`); the
 /// default name is the segment after the FIRST colon, so an id with embedded
 /// colons (`ns:a:b`) resolves to `a`. Ids without a colon are returned as-is.
 ///
@@ -131,7 +131,7 @@ mod default_client_name_tests {
 
     #[test]
     fn pins_first_colon_derivation() {
-        assert_eq!(default_client_name("GrokBuild:grep"), "grep");
+        assert_eq!(default_client_name("Kigi:grep"), "grep");
         assert_eq!(default_client_name("ns:a:b"), "a");
         assert_eq!(default_client_name("bare"), "bare");
         assert_eq!(default_client_name(""), "");