M0: compilable skeleton — Kigi 0.1.0 fork surgery

Hard fork of xai-org/grok-build (Apache-2.0) re-targeted as Kigi, an
unofficial Kimi Code CLI community build.

Rename & identity
- 72 xai-*/xai-grok-* crates -> kigi-* (explicit: xai-grok-pager-bin ->
  kigi-bin [binary `kigi`], xai-grok-pager -> kigi-tui; rest mechanical);
  ptyctl, ptyctl-cli, third_party/ unchanged; proto package
  xai.grok.tools.v1 -> kigi.tools.v1
- Config home ~/.kigi (KIGI_SHARE_DIR override), env prefix GROK_* ->
  KIGI_*, `kigi --version` carries the unofficial-community-build notice
- clap identity, help text, startup banner, prompt templates rebranded
  (templates re-encrypted)

Deletions (PRD removal list #5/#6/#7/#9/#10)
- voice input (xai-grok-voice) and all TUI wiring
- telemetry: Mixpanel client, external OTel stream, Sentry, OTLP layers,
  trace/GCS/S3 upload queues (kigi-file-utils halved), workspace upload
  module & dc_log, heap-profile uploader, auth-diagnostics uploader,
  session-analytics halves of feedback; local zero-egress observability
  preserved in new kigi-log crate (unified log, --debug firehose,
  subsystem file logs, opt-in instrumentation)
- announcements (crate, remote-settings fields, TUI surfaces)
- plugin marketplace (crate, sources/browse/CTA/extensions-modal tab);
  direct plugin install/uninstall/update via kigi-agent git_install kept
- relay/gateway/assets endpoints and features (agent relay, headless
  relay transport, gateway bridge, LeaderEnvUrls); leader IPC socket now
  ~/.kigi/leader.sock + KIGI_LEADER_SOCKET, no ws-url derivation
- functional types rehomed instead of deleted: PermissionMode ->
  kigi-config-types, McpInitStrategy -> kigi-mcp, PrCreationSource ->
  session signals, TerminalDiagnostics -> kigi-pager-render, agent_id ->
  shell util

Endpoints
- kigi-env rewritten: single production KigiEndpoints {coding_api_base_url
  https://api.kimi.com/coding/v1 (KIGI_CODE_BASE_URL), oauth_host
  https://auth.kimi.com (KIGI_OAUTH_HOST), update_base_url (GitHub
  Releases API), upgrade_page_url}; GrokBuildEnvironment enum deleted

Toolchain & workspace hygiene
- Rust 1.97.0 pinned; edition 2024; full cargo update; git2 hoisted to
  workspace at 0.21 (Option->Result API migration), quick-xml 0.41
- Root Cargo.toml hand-maintained (PRD §8.1): version 0.1.0 inherited by
  all members, members sorted, unused deps pruned
- cargo-deny advisories gate (deny.toml with documented transitive
  exceptions); CI workflow (check/clippy/fmt/deny/test, macOS+Linux)
- cross-crate test seams re-gated behind `test-support` cargo feature;
  insta snapshot baselines renamed to the kigi_tui prefix
- clippy --workspace --all-targets: zero warnings; fmt clean

Fixes surfaced by the port
- updater probe/installer divergence (bin/kigi vs bin/grok symlink set)
- idle model-metadata refresh dead under KIGI_CODE_BASE_URL override
  (new is_effective_coding_endpoint_url, loopback+override aware)
- macOS symlinked-TMPDIR fixture canonicalization (foreign_sessions,
  fast-worktree); RSS measurement tests serialized via serial_test

Docs & legal (Apache §4)
- NOTICE added (upstream attribution + change statement); THIRD-PARTY
  notices sustained; kigi-tools ported-code notices extended; README,
  CONTRIBUTING, SECURITY, AGENTS.md rewritten

Out of scope for M0 (tracked): Kimi auth/inference (M1), search/fetch,
command parity, config import (M2), Computer Hub excision & final
brand-token sweep (M2), distribution & self-update rewrite (M3).

crates/codegen/kigi-workspace/src/project_config.rs

@@ -0,0 +1,115 @@
+//! Project config-file discovery: locating repo-local `.mcp.json` and
+//! `.kigi/config.toml` files by walking from `cwd` up to the git root.
+//!
+//! These pure `git2` + filesystem walks are shared by the shell's config
+//! loaders and the folder-trust gate's `repo_configs_present`.
+
+use std::path::{Path, PathBuf};
+
+use kigi_agent::repo::RepoDirChain;
+
+/// Filename of the project-local MCP server config.
+pub const MCP_JSON_FILENAME: &str = ".mcp.json";
+
+/// Candidate `.mcp.json` paths from repo root to `cwd`, whether or not they exist.
+/// Useful for file watching so newly created files are detected after startup.
+pub fn mcp_json_candidate_paths(cwd: &Path) -> Vec<PathBuf> {
+    mcp_json_candidate_paths_in(&RepoDirChain::resolve(cwd).dirs)
+}
+
+/// [`mcp_json_candidate_paths`] over a precomputed cwd→git-root dir chain
+/// ([`RepoDirChain`]), repo-root-first. Private: only this file's two callers.
+fn mcp_json_candidate_paths_in(chain_dirs: &[PathBuf]) -> Vec<PathBuf> {
+    chain_dirs
+        .iter()
+        .rev()
+        .map(|dir| dir.join(MCP_JSON_FILENAME))
+        .collect()
+}
+
+/// Find existing `.mcp.json` files from `cwd` up to the git root (repo-root-first order).
+pub fn find_mcp_json_files(cwd: &Path) -> Vec<PathBuf> {
+    find_mcp_json_files_in(&RepoDirChain::resolve(cwd).dirs)
+}
+
+/// [`find_mcp_json_files`] over a precomputed dir chain. See [`RepoDirChain`].
+/// `pub(crate)` — the gate (`repo_configs_present`) reaches it within this crate.
+pub(crate) fn find_mcp_json_files_in(chain_dirs: &[PathBuf]) -> Vec<PathBuf> {
+    mcp_json_candidate_paths_in(chain_dirs)
+        .into_iter()
+        .filter(|path| path.is_file())
+        .collect()
+}
+
+/// True when `config_path` is `$KIGI_SHARE_DIR/config.toml` (user tier, not project).
+fn is_user_grok_config_file(config_path: &Path) -> bool {
+    let Some(user_home) = kigi_config::user_kigi_home() else {
+        return false;
+    };
+    let user_config = user_home.join("config.toml");
+    if config_path == user_config.as_path() {
+        return true;
+    }
+    let Ok(canonical_config) = dunce::canonicalize(config_path) else {
+        return false;
+    };
+    let canonical_user = dunce::canonicalize(&user_config).unwrap_or(user_config);
+    canonical_config == canonical_user
+}
+
+/// Find all `.kigi/config.toml` files from `cwd` upward to the git repo root.
+/// Returns paths ordered from repo root (lowest priority) to cwd (highest priority),
+/// matching the convention used by skills and AGENTS.md discovery.
+///
+/// If no git repo is found, only checks `cwd/.kigi/config.toml`. Excludes the
+/// user-global config so `cwd == $HOME` does not treat `~/.kigi/config.toml` as
+/// a project overlay.
+pub fn find_project_configs(cwd: &Path) -> Vec<PathBuf> {
+    find_project_configs_in(&RepoDirChain::resolve(cwd).dirs)
+}
+
+/// [`find_project_configs`] over a precomputed cwd→git-root dir chain
+/// ([`RepoDirChain`]), repo-root-first. Excludes the user-global config so
+/// `cwd == $HOME` does not treat `~/.kigi/config.toml` as a project overlay.
+/// `pub(crate)` — the gate (`repo_configs_present`) reaches it within this crate.
+pub(crate) fn find_project_configs_in(chain_dirs: &[PathBuf]) -> Vec<PathBuf> {
+    // `dirs` is cwd-first; reverse so repo root comes first (lowest priority)
+    // and cwd last (highest), matching skills/AGENTS.md discovery order.
+    chain_dirs
+        .iter()
+        .rev()
+        .map(|dir| dir.join(".kigi").join("config.toml"))
+        .filter(|config_path| config_path.is_file() && !is_user_grok_config_file(config_path))
+        .collect()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn find_project_configs_excludes_user_grok_config_file() {
+        let Some(user_home) = kigi_config::user_kigi_home() else {
+            return;
+        };
+        let user_config = user_home.join("config.toml");
+        if user_config.is_file() {
+            #[allow(deprecated)]
+            let home = std::env::home_dir().expect("home dir");
+            let from_home = find_project_configs(&home);
+            assert!(
+                !from_home.iter().any(|p| is_user_grok_config_file(p)),
+                "user config leaked into project configs: {from_home:?}"
+            );
+            assert!(is_user_grok_config_file(&user_config));
+        }
+
+        let tmp = tempfile::tempdir().unwrap();
+        let project = tmp.path().join("repo");
+        std::fs::create_dir_all(project.join(".kigi")).unwrap();
+        std::fs::write(project.join(".kigi/config.toml"), "# project\n").unwrap();
+        let found = find_project_configs(&project);
+        assert_eq!(found.len(), 1);
+        assert!(!is_user_grok_config_file(&found[0]));
+    }
+}