§9 acceptance: grep-zero sweep — every internal x.ai/grok identifier renamed

The PRD's first acceptance gate now holds: grep -RinE '\bx\.ai\b|grok'
crates/ --include='*.rs' → 0 matches (exempt: NOTICE and third-party
license archives, README provenance, and the required 'Based on Grok
Build Open Source' attribution, now sourced from version_attribution.txt).

Wire-visible renames (both sides in this repo, changed in lockstep):
- Auth method id 'grok.com' → 'kimi-code' (AuthMethodKind::KimiCode).
- Every x.ai/* and _x.ai/* ACP ext method and meta key → kigi/* /
  _kigi/* (~200 names; grokShell → kigiShell). Session-file replay keeps
  a read-side alias for the legacy '_x.ai/session/update' method so
  existing updates.jsonl histories load; writes emit only the new name
  (both directions test-pinned).
- Agent types grok-build* → kigi* with a documented legacy-prefix alias
  at resolution time so persisted sessions keep resolving.
- ToolNamespace/BuiltinAgentName GrokBuild* → Kigi* (wire snake_case
  kigi/kigi_concise/kigi_hashline; schema regenerated); grok_build
  implementation dirs renamed to kigi*.
- x-grok-* headers → x-kigi-*, __GROK_* sentinels → __KIGI_*, themes
  grokday/groknight → kigiday/kiginight (old persisted values fall back
  to the default theme), web_fetch allowlist xAI hosts → kimi.com +
  moonshot platforms, changelog CDN → this repo, grok-build changelog
  archives deleted.
- BYOK default endpoint removed: [endpoints] api_base_url is now truly
  optional with NO default — consumers fail fast with the flag name when
  unset (no silent x.ai egress). Mock harnesses inject it explicitly.
- System-prompt identity fixed: 'released by xAI' → 'an unofficial
  community CLI for Kimi' (template + regenerated encrypted form).

Also repaired pre-existing grok-era test debt found by the sweep: the
stale trace_classify default-model pin, the grok-pager UA label test,
pty-harness stale-binary reuse and non-hermetic moonshot routing (a PTY
test could previously reach the real api.moonshot.cn), and the outdated
oauth fixture scope key.

Gates: §9 grep 0; fmt clean; workspace check/clippy 0/0 (-D warnings);
FULL cargo test --workspace: 234 suites, 21,961 passed, 0 failed;
deny advisories ok.

crates/common/kigi-tool-protocol/tests/serde_roundtrip.rs

@@ -45,7 +45,7 @@ fn user() -> UserId {
 }
 
 fn tool() -> ToolId {
-    ToolId::new("GrokBuild:read_file").unwrap()
+    ToolId::new("Kigi:read_file").unwrap()
 }
 
 fn server() -> ServerId {
@@ -60,7 +60,7 @@ fn call_id() -> ToolCallId {
 fn id_types_round_trip_as_bare_strings() {
     assert_eq!(roundtrip(&session()), json!("sess_abc"));
     assert_eq!(roundtrip(&user()), json!("user_123"));
-    assert_eq!(roundtrip(&tool()), json!("GrokBuild:read_file"));
+    assert_eq!(roundtrip(&tool()), json!("Kigi:read_file"));
     assert_eq!(roundtrip(&server()), json!("srv-uuidv7"));
     assert_eq!(
         roundtrip(&ConnectionId::new("conn_42").unwrap()),
@@ -257,7 +257,7 @@ fn tool_registration_round_trips_with_and_without_server_id() {
         sessions: Some(vec![session()]),
         user_id: user(),
         server_id: None,
-        description: sample_description("read_file", Some("GrokBuild")),
+        description: sample_description("read_file", Some("Kigi")),
         input_schema: Some(json!({"type": "object"})),
         capabilities: None,
         notification_schemas: None,
@@ -392,7 +392,7 @@ fn registration_outcome_variants_round_trip() {
     for (outcome, expected_tag) in cases {
         let json = roundtrip(&outcome);
         assert_eq!(json["outcome"], json!(expected_tag));
-        assert_eq!(json["tool_id"], json!("GrokBuild:read_file"));
+        assert_eq!(json["tool_id"], json!("Kigi:read_file"));
     }
 }
 
@@ -847,7 +847,7 @@ fn tool_registration_round_trips() {
         sessions: Some(vec![session()]),
         user_id: user(),
         server_id: None,
-        description: ToolDescription::new("read_file", "d").with_namespace("GrokBuild"),
+        description: ToolDescription::new("read_file", "d").with_namespace("Kigi"),
         input_schema: None,
         capabilities: None,
         notification_schemas: None,
@@ -936,13 +936,13 @@ fn session_lifecycle_payloads_round_trip() {
     let bind_result = SessionBindServerResult {
         tools: vec![ToolDescription::new("my_tool", "desc")],
         binary_version: Some("1.0.15".to_owned()),
-        unserved_tool_ids: vec!["GrokBuild:monitor".to_owned()],
+        unserved_tool_ids: vec!["Kigi:monitor".to_owned()],
         resolve_error: Some("missing_tool_config: no explicit tool configuration".to_owned()),
     };
     let v = roundtrip(&bind_result);
     assert_eq!(v["tools"].as_array().unwrap().len(), 1);
     assert_eq!(v["binary_version"], json!("1.0.15"));
-    assert_eq!(v["unserved_tool_ids"], json!(["GrokBuild:monitor"]));
+    assert_eq!(v["unserved_tool_ids"], json!(["Kigi:monitor"]));
     assert_eq!(
         v["resolve_error"],
         json!("missing_tool_config: no explicit tool configuration")
@@ -1140,7 +1140,7 @@ fn hook_frame_round_trips_with_optional_fields() {
 fn session_event_turn_started_round_trips_via_re_export() {
     let event = SessionEvent::TurnStarted {
         turn_number: 10,
-        model_id: "grok-3".into(),
+        model_id: "kigi-3".into(),
         yolo_mode: true,
     };
     let v = roundtrip(&event);
@@ -1196,8 +1196,8 @@ fn tools_changed_round_trips_with_per_array_skip_when_empty() {
         updated: vec![tool()],
     };
     let v = roundtrip(&populated);
-    assert_eq!(v["added"][0], json!("GrokBuild:read_file"));
-    assert_eq!(v["updated"][0], json!("GrokBuild:read_file"));
+    assert_eq!(v["added"][0], json!("Kigi:read_file"));
+    assert_eq!(v["updated"][0], json!("Kigi:read_file"));
     assert!(!v.as_object().unwrap().contains_key("removed"));
 }
 
@@ -1479,12 +1479,12 @@ fn tool_error_wire_render_limited_omits_card_id_when_none() {
 #[test]
 fn tool_error_wire_terminal_error_round_trips_with_string_code() {
     let err = ToolErrorWire::TerminalError {
-        tool_id: ToolId::new("GrokBuild:bash").unwrap(),
+        tool_id: ToolId::new("Kigi:bash").unwrap(),
         message: "exit 137".to_owned(),
     };
     let v = roundtrip(&err);
     assert_eq!(v["code"], json!("terminal_error"));
-    assert_eq!(v["tool_id"], json!("GrokBuild:bash"));
+    assert_eq!(v["tool_id"], json!("Kigi:bash"));
     assert_eq!(v["message"], json!("exit 137"));
 }