§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-tui/src/app/app_view.rs

@@ -501,19 +501,19 @@ pub struct AppView {
     /// (`team_name.is_some()`) and API-key auth.
     pub usage_visible: bool,
     /// Whether the pager is connected via a leader (leader mode). The Agent
-    /// Dashboard entry points (`/dashboard`, `Ctrl+\`, `grok dashboard`, the
+    /// Dashboard entry points (`/dashboard`, `Ctrl+\`, `kigi dashboard`, the
     /// startup hook) are only meaningful when a leader is coordinating a
     /// fleet of sessions, so they are gated on this flag. Set in
     /// `event_loop::run` from `connection.leader_status_rx.is_some()`;
     /// defaults to `false` (non-leader, dashboard hidden).
     pub leader_mode: bool,
     /// Leader-mode session roster (FleetView dashboard). Populated from
-    /// `x.ai/sessions/list` polls and `x.ai/sessions/changed` broadcasts.
+    /// `kigi/sessions/list` polls and `kigi/sessions/changed` broadcasts.
     /// Empty in non-leader mode, which naturally gates roster rendering.
     pub leader_roster: Vec<crate::app::roster::RosterEntry>,
     /// Local on-disk session list (dormant/idle sessions) surfaced on the
     /// dashboard when NOT in leader mode. There is no live leader roster to
-    /// poll outside leader mode, so we fetch the same `x.ai/session/list` the
+    /// poll outside leader mode, so we fetch the same `kigi/session/list` the
     /// resume picker uses and render those as idle rows. Entries are stored as
     /// [`crate::app::roster::RosterEntry`] (activity `Dormant`) so they reuse
     /// the existing roster-row rendering / attach path. Empty in leader mode.
@@ -521,14 +521,14 @@ pub struct AppView {
     /// Whether the dashboard is currently loading local sessions (non-leader mode).
     pub dashboard_sessions_loading: bool,
     /// Server-authoritative shared prompt queues, keyed by `sessionId`
-    /// Reconciled from `x.ai/queue/changed` broadcasts so
+    /// Reconciled from `kigi/queue/changed` broadcasts so
     /// every client renders the same ordered queue (including prompts queued
     /// by other clients). Empty in non-leader mode.
     pub shared_prompt_queues:
         std::collections::HashMap<String, Vec<crate::app::prompt_queue::QueueEntryWire>>,
     /// Optimistic echo rows for prompts the pager sent server-authoritatively
     /// (plain prompt typed while a turn is running) but for which the
-    /// confirming `x.ai/queue/changed` broadcast has not yet arrived. Keyed by
+    /// confirming `kigi/queue/changed` broadcast has not yet arrived. Keyed by
     /// `sessionId`. Pinned into `shared_prompt_queues` on reconcile so the row
     /// doesn't flicker, and dropped once the authoritative broadcast reflects
     /// the id (or it starts running). Never persisted.
@@ -551,7 +551,7 @@ pub struct AppView {
     pub cancel_rewind_enabled: bool,
     /// Whether session recap (`/recap` + automatic away recap) is rolled out,
     /// resolved by the shell and advertised on ACP initialize (`sessionRecap`).
-    /// When false, the pager must not request recaps (zero `x.ai/recap` traffic).
+    /// When false, the pager must not request recaps (zero `kigi/recap` traffic).
     pub session_recap_available: bool,
     /// Stateful prompt widget rendered on the welcome screen (persists input across frames).
     pub welcome_prompt: PromptWidget,
@@ -715,7 +715,7 @@ pub struct AppView {
     /// Automatically enabled by `plan_mode`.
     pub ask_user: bool,
     /// Process-wide gateway light-frontend from CLI `--chat` only.
-    /// Stamps `_meta["x.ai/session"].kind = "chat"` and omits Build agent
+    /// Stamps `_meta["kigi/session"].kind = "chat"` and omits Build agent
     /// profiles on create/load while set. `/chat` does **not** set this
     /// (uses [`Self::deferred_startup`] one-shot state instead).
     pub chat_mode: bool,
@@ -776,7 +776,7 @@ pub struct AppView {
     /// when `Pending`, the welcome screen shows the trust question and session
     /// creation is deferred (gated after auth) until it is answered.
     pub trust_state: TrustState,
-    /// Login button label from `AuthMethod.name` (e.g., "grok.com", "Acme Corp").
+    /// Login button label from `AuthMethod.name` (e.g., "kimi-code", "Acme Corp").
     pub login_label: Option<String>,
     /// The auth method ID to use for login.
     pub login_method_id: Option<acp::AuthMethodId>,
@@ -1125,7 +1125,7 @@ impl AppView {
         }
     }
     /// Reconcile the shared prompt queue for a session from a
-    /// `x.ai/queue/changed` broadcast. The broadcast is
+    /// `kigi/queue/changed` broadcast. The broadcast is
     /// authoritative: it fully replaces the previously-known queue for that
     /// session. An empty list clears the entry.
     ///
@@ -1194,7 +1194,7 @@ impl AppView {
     /// Push an optimistic echo row for a server-authoritative prompt the pager
     /// just sent (a plain prompt or agent-bound kind typed while a turn is
     /// running). The row is keyed by `prompt_id` so the authoritative
-    /// `x.ai/queue/changed` broadcast replaces it (matched by `id`) rather than
+    /// `kigi/queue/changed` broadcast replaces it (matched by `id`) rather than
     /// duplicating it. `kind` (`"prompt"`/`"bash"`/…) drives the row's display
     /// and, on adoption, the turn-start shim's block + focus flag.
     pub fn push_optimistic_prompt_echo(
@@ -8264,9 +8264,7 @@ pub(crate) mod tests {
         n_questions: usize,
     ) {
         use crate::views::question_view::QuestionViewState;
-        use kigi_tools::implementations::grok_build::ask_user_question::{
-            Question, QuestionOption,
-        };
+        use kigi_tools::implementations::kigi::ask_user_question::{Question, QuestionOption};
         let questions: Vec<Question> = (0..n_questions)
             .map(|i| Question {
                 question: format!("Q{i}?"),