M2 audit: excise the Computer Hub stack — Kigi's last remote-cloud surface

Removed root-and-branch for the zero-egress guarantee (the hub was xAI's
remote-workspace/cloud-sandbox service):

- Crates deleted: kigi-computer-hub-core, kigi-computer-hub-sdk,
  kigi-computer-hub-mcp-adapter, kigi-workspace-client (hub-proxied
  workspace RPC client), and kigi-tracing (its sole network path was the
  OTLP gRPC exporter; zero consumers remained). kigi-tracing-macros
  (purely local) stays.
- kigi-workspace: every hub surface deleted — hub server/channel/auth,
  HITL-over-hub permissions, donation/metrics pumps, file upload RPCs,
  hub tool-snapshot merge (resolve pipeline is MCP-only now),
  WorkspaceOps::Proxy. Local worktrees, sessions, leader IPC, MCP, and
  the ACP permission prompt path are untouched; LocalRegistry re-homed
  into kigi-tool-runtime on the existing ToolDyn types so in-process
  tool dispatch is unchanged.
- kigi-shell: leader workspace-exposure control surface (incl. the
  wss://computer-hub... URL), [hub] config, ObservabilityBridge, hub
  WebSocket proxy, dead OTLP config knobs. ClientMode::Headless (never
  constructed) removed.
- kigi-tui/bin: hidden `kigi workspace` command removed (`kigi
  worktree` stays).
- Renames: --xai-api-base-url → --api-base-url / KIGI_API_BASE_URL /
  [endpoints] api_base_url (serde alias keeps old configs working; the
  flag feeds BYOK/custom-endpoint routing, not main inference);
  grok_version → kigi_version in inspect/models-cache/trace metadata
  (old caches self-heal via version-mismatch refetch).
- Dependency tree: dropped fastrace*, opentelemetry-otlp/http/proto,
  tokio-tungstenite from the workspace; fixed the 4 real useless_format
  violations the fastrace lint allowance was masking and removed the
  allowance.
- marketplaceAllowlist kept: it gates the LOCAL plugin-marketplace
  feature, not an xAI service.

Known §9 leftover (deliberate, for the M3 sweep): the BYOK default base
URL string. Gates: workspace check/clippy 0/0, fmt, deny ok; suites
green (workspace 1042, shell 4918, tui 6634, tools 2608, tool-runtime
47, mcp 154).

crates/codegen/kigi-shell/src/agent/mvp_agent/tests.rs

@@ -652,7 +652,6 @@ async fn file_toolset_override_e2e_to_finalized_toolset() {
         video_gen_config: kigi_tools::implementations::grok_build::video_gen::VideoGenConfig::default(),
         app_builder_deployer_config: kigi_tools::implementations::grok_build::deploy_app::AppBuilderDeployerConfig::default(),
         api_key_provider: None,
-        auth_provider: None,
         attribution_callback: None,
         system_reminder_tag: kigi_tools::reminders::DEFAULT_REMINDER_TAG,
     };
@@ -3183,7 +3182,6 @@ fn interactive_trust_prompt_reprompts_after_untrust() {
 }
 mod direct_hub_cloud_removed {
     use super::super::{DIRECT_HUB_CLOUD_REMOVED_MSG, reject_direct_hub_cloud_meta};
-    use crate::agent::config::HubConfig;
     fn assert_direct_hub_error(err: agent_client_protocol::Error) {
         assert_eq!(
             err.data.as_ref(),
@@ -3238,38 +3236,6 @@ mod direct_hub_cloud_removed {
             .is_ok()
         );
     }
-    #[test]
-    fn hub_url_gating_matrix() {
-        let with_url = HubConfig {
-            url: Some("wss://hub.example/ws".into()),
-        };
-        let without_url = HubConfig { url: None };
-        let blank = HubConfig {
-            url: Some("   ".into()),
-        };
-        assert!(with_url.is_enabled());
-        assert!(!without_url.is_enabled());
-        assert!(!blank.is_enabled());
-    }
-    #[test]
-    fn hub_config_is_url_only_workspace_default() {
-        let json = serde_json::to_value(HubConfig {
-            url: Some("wss://hub.example/ws".into()),
-        })
-        .expect("serialize");
-        let obj = json.as_object().expect("object");
-        assert_eq!(
-            obj.keys().collect::<Vec<_>>(),
-            vec!["url"],
-            "HubConfig must only serialize url (no proxy-mode fields)"
-        );
-        let from_legacy: HubConfig = serde_json::from_value(serde_json::json!(
-            { "url" : "wss://hub.example/ws", "workspace_mode" : "remote",
-            "send_turn_hooks" : false, }
-        ))
-        .expect("ignore unknown fields");
-        assert_eq!(from_legacy.url.as_deref(), Some("wss://hub.example/ws"));
-    }
 }
 mod soft_default_settings_emit {
     use super::*;