Add a Grok Build TUI host shim to the AGT reference implementation

[antman1p]

What changed

Adds a third AGT host, Grok Build TUI, as a subprocess shim against the existing host adapter. The Guardian, the AGT bridge, mapping.yaml, policy/lib, and the Claude Code shim are unchanged.

Grok's measured payload (1.0.25 in #107, rechecked live on 1.0.62) uses run_terminal_command and a tagged tool_response whose model-facing leaf is output_for_prompt. Native defer on PreToolUse renders as defer. The result gate patches output_for_prompt inside the tagged object so Grok does not drop the replacement.

policy/manifest.yaml registers run_terminal_command with security_labels: [shell], additive, so the stock pattern rule can evaluate it instead of failing closed as tool_unknown.

Parked, documented in the host README: tool_response.output is a byte array sibling of output_for_prompt. A redaction patches the model-facing leaf and leaves the byte array as it was.

Which issue does this implement

Closes #108
Refs #107

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI
• main, because every changed path is on the documentation lane allowlist in
  CONTRIBUTING.md

Type of change

• Specification change (schema, hooks, events, AgBOM)
• Reference implementation or adapter
• Documentation
• Tooling or CI
• Governance (licensing, security policy, contributor docs)

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine
• uv run mkdocs build --strict passes on my machine

From reference-implementations/agt/:

• bun run typecheck is clean
• bun test: 1285 pass, 1 skip, 0 fail across 77 files
• bun test hosts/grok: 51 pass, 0 fail
• Frozen paths (Guardian, bridge, policy/lib, mapping.yaml, Claude Code source) are unchanged in the working tree. bun run verify:zero-diff exits 1 in this repository because slice/v4 is gone, which the AGT README already records.

Live Grok 1.0.62, hook copied to ~/.grok/hooks/acs-agt.json, Guardian on 8787:

• echo rm -rf / denied as destructive_shell_command_blocked at offset 5, tool name run_terminal_command, not tool_unknown
• echo dogfood-allow allowed on steps/toolCallRequest and steps/toolCallResult; Grok printed dogfood-allow

Root: uv run pytest -v 918 passed, 1 skipped. uv run mkdocs build --strict passes.

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

This change adds a governance hook for Grok's shell tool. It does not change Guardian policy.

The negotiated failure posture remains proceed. If the Guardian is down, PreToolUse fail-opens after an audit entry, same as the other hosts.

A redaction at the result gate patches output_for_prompt and does not mirror the byte-array output sibling. That residual is documented in hosts/grok/README.md and grok.hookmap.yaml.

[github-actions]

This pull request's description says it closes #108, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging.