M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.

Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
  kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
  ptyctl, ptyctl-cli, third_party/ unchanged; proto package
  xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
  KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
  (templates re-encrypted)

Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
  trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
  module & dc_log, heap-profile uploader, auth-diagnostics uploader,
  session-analytics halves of feedback; local zero-egress observability
  preserved in new kigi-log crate (unified log, --debug firehose,
  subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
  direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
  relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
  ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
  kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
  session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
  shell util

Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
  https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
  https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
  Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted

Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
  workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
  all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
  exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
  insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean

Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
  (new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
  fast-worktree); RSS measurement tests serialized via serial_test

Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
  notices sustained; kigi-tools ported-code notices extended; README,
  CONTRIBUTING, SECURITY, AGENTS.md rewritten

Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).

crates/codegen/kigi-sampler/src/actor/mod.rs

@@ -0,0 +1,145 @@
+//! Sampler actor: owns global state, spawns per-request tasks.
+//!
+//! The actor task itself is single-threaded -- it processes one
+//! command at a time -- but it spawns `tokio::spawn` per-request
+//! tasks for the actual streaming work, so multiple requests can be
+//! in flight concurrently.
+
+pub(crate) mod request_task;
+pub(crate) mod state;
+
+use tokio::sync::mpsc;
+use tokio::task::JoinSet;
+use tokio_util::sync::CancellationToken;
+
+use crate::commands::SamplerCommand;
+use crate::config::{RetryPolicy, SamplerConfig};
+use crate::events::SamplingEvent;
+use crate::handle::SamplerHandle;
+use state::{ActiveRequest, ActorState};
+
+use crate::types::RequestId;
+
+/// Sampler actor.
+///
+/// Construct via [`SamplerActor::spawn`]; the returned
+/// [`SamplerHandle`] is the only supported way to interact with it.
+pub struct SamplerActor {
+    cmd_rx: mpsc::UnboundedReceiver<SamplerCommand>,
+    event_tx: mpsc::UnboundedSender<SamplingEvent>,
+    state: ActorState,
+    /// Per-request tasks. The actor's run loop selects on
+    /// `cmd_rx.recv()` and `tasks.join_next()`; when a task finishes
+    /// it returns its `RequestId` so the actor can clean up
+    /// `active_requests`.
+    tasks: JoinSet<RequestId>,
+}
+
+impl SamplerActor {
+    /// Spawn the actor on the current tokio runtime and return a
+    /// handle. The actor stops when the returned handle (and all its
+    /// clones) are dropped.
+    pub fn spawn(
+        config: SamplerConfig,
+        retry_policy: RetryPolicy,
+        event_tx: mpsc::UnboundedSender<SamplingEvent>,
+    ) -> SamplerHandle {
+        let (cmd_tx, cmd_rx) = mpsc::unbounded_channel();
+        let actor = Self {
+            cmd_rx,
+            event_tx,
+            state: ActorState::new(config, retry_policy),
+            tasks: JoinSet::new(),
+        };
+        tokio::spawn(actor.run());
+        SamplerHandle::new(cmd_tx)
+    }
+
+    async fn run(mut self) {
+        loop {
+            tokio::select! {
+                biased;
+                // Prefer cleaning up finished tasks before processing
+                // new commands -- prevents `active_requests` from
+                // staying stale longer than necessary.
+                Some(joined) = self.tasks.join_next(), if !self.tasks.is_empty() => {
+                    match joined {
+                        Ok(request_id) => {
+                            // Task finished normally; remove from
+                            // active set unless the user has already
+                            // cancelled it (Cancel removes it too).
+                            self.state.remove(&request_id);
+                        }
+                        Err(join_err) => {
+                            tracing::warn!(
+                                error = %join_err,
+                                "request task panicked or was aborted"
+                            );
+                        }
+                    }
+                }
+                cmd = self.cmd_rx.recv() => {
+                    match cmd {
+                        Some(cmd) => self.handle_command(cmd),
+                        None => break, // all handles dropped
+                    }
+                }
+            }
+        }
+
+        // Cancel any still-running tasks before exiting so they don't
+        // leak. The cancellation token shutdown is best-effort.
+        for (_, active) in self.state.active_requests.drain() {
+            active.cancel_token.cancel();
+        }
+        self.tasks.shutdown().await;
+    }
+
+    fn handle_command(&mut self, cmd: SamplerCommand) {
+        match cmd {
+            SamplerCommand::Submit {
+                request_id,
+                request,
+                config,
+                completion_tx,
+            } => {
+                let cancel_token = CancellationToken::new();
+                let active = ActiveRequest {
+                    cancel_token: cancel_token.clone(),
+                };
+                if let Some(prev) = self.state.register(request_id.clone(), active) {
+                    // Caller submitted a duplicate id; cancel the
+                    // previous one so we don't leak its task.
+                    prev.cancel_token.cancel();
+                }
+                let effective_config = config
+                    .map(|b| *b)
+                    .unwrap_or_else(|| self.state.config.clone());
+                let event_tx = self.event_tx.clone();
+                let retry_policy = self.state.retry_policy.clone();
+                let request_inner = *request;
+                self.tasks.spawn(request_task::run_request_task(
+                    request_id,
+                    request_inner,
+                    effective_config,
+                    retry_policy,
+                    event_tx,
+                    cancel_token,
+                    completion_tx,
+                ));
+            }
+            SamplerCommand::Cancel { request_id } => {
+                self.state.cancel(&request_id);
+            }
+            SamplerCommand::UpdateConfig { config } => {
+                self.state.update_config(*config);
+            }
+            SamplerCommand::IsActive { request_id, reply } => {
+                let _ = reply.send(self.state.active_requests.contains_key(&request_id));
+            }
+            SamplerCommand::ActiveCount { reply } => {
+                let _ = reply.send(self.state.active_requests.len());
+            }
+        }
+    }
+}