M2 audit: excise the Computer Hub stack — Kigi's last remote-cloud surface

Removed root-and-branch for the zero-egress guarantee (the hub was xAI's
remote-workspace/cloud-sandbox service):

- Crates deleted: kigi-computer-hub-core, kigi-computer-hub-sdk,
  kigi-computer-hub-mcp-adapter, kigi-workspace-client (hub-proxied
  workspace RPC client), and kigi-tracing (its sole network path was the
  OTLP gRPC exporter; zero consumers remained). kigi-tracing-macros
  (purely local) stays.
- kigi-workspace: every hub surface deleted — hub server/channel/auth,
  HITL-over-hub permissions, donation/metrics pumps, file upload RPCs,
  hub tool-snapshot merge (resolve pipeline is MCP-only now),
  WorkspaceOps::Proxy. Local worktrees, sessions, leader IPC, MCP, and
  the ACP permission prompt path are untouched; LocalRegistry re-homed
  into kigi-tool-runtime on the existing ToolDyn types so in-process
  tool dispatch is unchanged.
- kigi-shell: leader workspace-exposure control surface (incl. the
  wss://computer-hub... URL), [hub] config, ObservabilityBridge, hub
  WebSocket proxy, dead OTLP config knobs. ClientMode::Headless (never
  constructed) removed.
- kigi-tui/bin: hidden `kigi workspace` command removed (`kigi
  worktree` stays).
- Renames: --xai-api-base-url → --api-base-url / KIGI_API_BASE_URL /
  [endpoints] api_base_url (serde alias keeps old configs working; the
  flag feeds BYOK/custom-endpoint routing, not main inference);
  grok_version → kigi_version in inspect/models-cache/trace metadata
  (old caches self-heal via version-mismatch refetch).
- Dependency tree: dropped fastrace*, opentelemetry-otlp/http/proto,
  tokio-tungstenite from the workspace; fixed the 4 real useless_format
  violations the fastrace lint allowance was masking and removed the
  allowance.
- marketplaceAllowlist kept: it gates the LOCAL plugin-marketplace
  feature, not an xAI service.

Known §9 leftover (deliberate, for the M3 sweep): the BYOK default base
URL string. Gates: workspace check/clippy 0/0, fmt, deny ok; suites
green (workspace 1042, shell 4918, tui 6634, tools 2608, tool-runtime
47, mcp 154).

crates/codegen/kigi-tools/src/implementations/grok_build_hashline/edit/apply.rs

@@ -2093,11 +2093,11 @@ mod tests {
         assert!(validate_anchor(&padded, &lines, &scheme).is_err());
 
         // Stale anchor with arrow reports the stripped anchor in error metadata.
-        let stale = format!("2:zzz:zzz\u{2192}content");
+        let stale = "2:zzz:zzz\u{2192}content".to_string();
         let err = validate_anchor(&stale, &lines, &scheme).unwrap_err();
         assert_eq!(err.requested_anchor.as_deref(), Some("2:zzz:zzz"));
 
-        let stale_ascii = format!("2:zzz:zzz->content");
+        let stale_ascii = "2:zzz:zzz->content".to_string();
         let err = validate_anchor(&stale_ascii, &lines, &scheme).unwrap_err();
         assert_eq!(err.requested_anchor.as_deref(), Some("2:zzz:zzz"));
     }

crates/codegen/kigi-tools/src/implementations/search_tool/mod.rs

@@ -90,7 +90,7 @@ pub fn build_server_reminder(
         return None;
     }
 
-    let mut text = format!("Connected MCP servers:\n",);
+    let mut text = "Connected MCP servers:\n".to_string();
     for server in servers {
         text.push_str(&format_server_line(server));
     }

crates/codegen/kigi-tools/src/registry/types.rs

@@ -283,12 +283,6 @@ pub struct SessionContext {
     /// instead of using the key baked into their config at construction time.
     /// Prevents 401 failures when a session outlives the initial token lifetime.
     pub api_key_provider: Option<crate::types::SharedApiKeyProvider>,
-    /// Auth provider which returns a kigi_computer_hub_sdk::AuthCredential. Can be used by
-    /// tools that need to authenticate with services.
-    ///
-    /// Not to be confused with the api_key_provider, which is a legacy
-    /// provider used by the shell's auth manager.
-    pub auth_provider: Option<kigi_computer_hub_sdk::SharedAuthProvider>,
     /// Optional 401-attribution callback for tool HTTP clients. When
     /// set, a 401 from `image_gen` / `video_gen` / `web_search`
     /// emits an `auth_401_attribution` event via this hook. Hosts can
@@ -351,7 +345,7 @@ type OutputConverter =
 /// `.await`.
 struct DispatchParts {
     /// Resolved `LocalRegistry` handle to dispatch through.
-    lr_handle: Arc<dyn kigi_computer_hub_core::ToolHandle>,
+    lr_handle: kigi_tool_runtime::ArcTool,
     /// Runtime context built for the call (resources, renderer, cwd,
     /// behavior version, inner-dispatch).
     ctx: kigi_tool_runtime::ToolCallContext,
@@ -394,7 +388,7 @@ struct ToolEntry {
     >,
     /// Registers this tool into a `LocalRegistry` using the concrete type.
     /// Captured at `register::<T>()` time when T is known.
-    register_in_local: Box<dyn Fn(&kigi_computer_hub_sdk::LocalRegistry) + Send + Sync>,
+    register_in_local: Box<dyn Fn(&kigi_tool_runtime::LocalRegistry) + Send + Sync>,
 }
 /// Per-reminder metadata stored in the builder.
 struct ReminderEntry {
@@ -450,7 +444,7 @@ pub struct FinalizedToolset {
     scheduler_cancel: Option<tokio_util::sync::CancellationToken>,
     /// Shared local registry for in-process dispatch.
     /// Contains only config-enabled tools. Can be shared with ToolHarness.
-    local_registry: kigi_computer_hub_sdk::LocalRegistry,
+    local_registry: kigi_tool_runtime::LocalRegistry,
     /// Lock-free access to the template renderer for tool name/param resolution.
     /// Cloned into `ToolCallContext::extensions` on each `call()` so tools
     /// can resolve names without acquiring the `resources` mutex.
@@ -519,7 +513,7 @@ impl RequirementError {
 pub struct ToolRegistryBuilder {
     tools: HashMap<String, ToolEntry>,
     reminders: Vec<ReminderEntry>,
-    shared_local_registry: Option<kigi_computer_hub_sdk::LocalRegistry>,
+    shared_local_registry: Option<kigi_tool_runtime::LocalRegistry>,
 }
 impl Default for ToolRegistryBuilder {
     fn default() -> Self {
@@ -613,7 +607,7 @@ impl ToolRegistryBuilder {
                     let typed = serde_json::from_value::<T::Args>(json)?;
                     Ok(typed.into())
                 }),
-                register_in_local: Box::new(|lr: &kigi_computer_hub_sdk::LocalRegistry| {
+                register_in_local: Box::new(|lr: &kigi_tool_runtime::LocalRegistry| {
                     lr.register(T::default());
                 }),
             },
@@ -744,7 +738,7 @@ impl ToolRegistryBuilder {
         }
         b
     }
-    pub fn with_local_registry(mut self, registry: kigi_computer_hub_sdk::LocalRegistry) -> Self {
+    pub fn with_local_registry(mut self, registry: kigi_tool_runtime::LocalRegistry) -> Self {
         self.shared_local_registry = Some(registry);
         self
     }
@@ -990,9 +984,6 @@ impl ToolRegistryBuilder {
         if let Some(memory_backend) = ctx.memory_backend {
             resources.insert(memory_backend);
         }
-        if let Some(auth_provider) = ctx.auth_provider.clone() {
-            resources.insert(auth_provider);
-        }
         if let Ok(client) = crate::implementations::web_search::client::WebSearchClient::new(
             &ctx.web_search_config,
             ctx.api_key_provider.clone(),
@@ -1265,7 +1256,7 @@ impl FinalizedToolset {
             )),
             resources_persistence: Arc::new(ResourcesPersistence::noop()),
             scheduler_cancel: None,
-            local_registry: kigi_computer_hub_sdk::LocalRegistry::new(),
+            local_registry: kigi_tool_runtime::LocalRegistry::new(),
             renderer: Arc::new(TemplateRenderer::new(
                 std::collections::HashMap::new(),
                 std::collections::HashMap::new(),
@@ -1274,9 +1265,6 @@ impl FinalizedToolset {
             workspace_viewer_ctx: None,
         }
     }
-    pub fn local_registry(&self) -> &kigi_computer_hub_sdk::LocalRegistry {
-        &self.local_registry
-    }
     /// Get all tool definitions to send to the client.
     pub fn tool_definitions(&self) -> Vec<ToolDefinition> {
         self.tools
@@ -2018,7 +2006,6 @@ mod tests {
             app_builder_deployer_config:
                 crate::implementations::grok_build::deploy_app::AppBuilderDeployerConfig::default(),
             api_key_provider: None,
-            auth_provider: None,
             attribution_callback: None,
             system_reminder_tag: crate::reminders::DEFAULT_REMINDER_TAG,
         }