§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/codegen/kigi-tui/src/wrap_cmd.rs

@@ -1,6 +1,6 @@
-//! `grok wrap` — run any command in a local PTY that forwards its clipboard.
+//! `kigi wrap` — run any command in a local PTY that forwards its clipboard.
 //!
-//! Generalizes the `grok ssh` wrapper: spawns an arbitrary command inside a
+//! Generalizes the `kigi ssh` wrapper: spawns an arbitrary command inside a
 //! local pseudo-terminal, intercepts OSC 52 clipboard escape sequences from
 //! its output, and writes their payload to the local system clipboard. Useful
 //! for containerized or remote shells (`docker exec`, `kubectl exec`, ...)
@@ -8,7 +8,7 @@
 //! that do not handle OSC 52 themselves (for example Apple Terminal).
 //!
 //! Resolvable programs spawn directly. On Unix, commands a direct spawn cannot
-//! run — a single shell-quoted string (`grok wrap "mycli ssh host"`) or a shell
+//! run — a single shell-quoted string (`kigi wrap "mycli ssh host"`) or a shell
 //! alias — are handed to `$SHELL -i -c` instead, so the user's own shell does
 //! the word-splitting and alias expansion. The exec fallback (a non-TTY
 //! session, or PTY setup failure) keeps the same route but drops `-i` to
@@ -20,7 +20,7 @@ use anyhow::Result;
 
 use crate::app::WrapArgs;
 
-/// Run the `grok wrap` command.
+/// Run the `kigi wrap` command.
 ///
 /// On Unix interactive sessions the command runs inside a local PTY so its
 /// OSC 52 clipboard sequences can be intercepted and written to the local
@@ -30,7 +30,7 @@ pub fn run(args: &WrapArgs) -> Result<()> {
     let program = args
         .command
         .first()
-        .ok_or_else(|| anyhow::anyhow!("grok wrap: no command given"))?;
+        .ok_or_else(|| anyhow::anyhow!("kigi wrap: no command given"))?;
 
     // Unix: derive both spawn plans up front from one env snapshot so the PTY
     // attempt and its fallback route consistently. The wrapped run uses
@@ -62,7 +62,7 @@ pub fn run(args: &WrapArgs) -> Result<()> {
             Err(e) => {
                 // PTY setup failed; keep the chosen route without our PTY so
                 // the command still works (just without clipboard forwarding).
-                eprintln!("grok wrap: wrapped mode failed, running without PTY wrapping: {e}");
+                eprintln!("kigi wrap: wrapped mode failed, running without PTY wrapping: {e}");
                 exec_command(&fallback.program, &fallback.args)
             }
         }
@@ -71,7 +71,7 @@ pub fn run(args: &WrapArgs) -> Result<()> {
     }
 }
 
-/// The program and argv `grok wrap` will actually spawn.
+/// The program and argv `kigi wrap` will actually spawn.
 #[derive(Clone)]
 struct SpawnPlan {
     program: String,
@@ -112,7 +112,7 @@ fn derive_spawn(
     };
 
     // A single argument containing whitespace is a shell-quoted command line
-    // (`grok wrap "mycli ssh host"`), not a program name: hand it to the shell
+    // (`kigi wrap "mycli ssh host"`), not a program name: hand it to the shell
     // verbatim so it does word-splitting, alias expansion, pipes, etc.
     if command.len() == 1 && command[0].contains(char::is_whitespace) {
         return via_shell(command[0].clone());
@@ -122,7 +122,7 @@ fn derive_spawn(
     // (`alias mycli=remote`); only a shell can expand it. Explicit paths
     // (containing `/`) spawn directly so their errors stay precise, as do
     // empty and whitespace-containing first words — neither can be an alias
-    // name, and an empty one (`grok wrap "$PROG" ...` with `$PROG` unset)
+    // name, and an empty one (`kigi wrap "$PROG" ...` with `$PROG` unset)
     // must keep failing fast instead of silently running the tail.
     if !command[0].is_empty()
         && !command[0].contains('/')
@@ -183,7 +183,7 @@ fn resolve_shell(shell: Option<&str>) -> String {
 
 /// Returns true when the command should be wrapped in a local PTY.
 ///
-/// Unlike `grok ssh`, `grok wrap` does not gate on the terminal brand: the user
+/// Unlike `kigi ssh`, `kigi wrap` does not gate on the terminal brand: the user
 /// has explicitly asked to forward the clipboard, and interception works
 /// regardless of whether the outer terminal supports OSC 52 (the payload is
 /// written to the local clipboard directly).