Sync 3: Improve Grok authentication and failure handling #39

Priority 3 of 5 runner fixes.

Port upstream's Grok fixes together:

• Recognize subscription login and You are using XAI_API_KEY. authentication, while rejecting explicit auth and model errors.
• Match exact model tokens so a neighboring model name cannot satisfy preflight.
• Preserve terminal cancellation/error messages, session identity, model evidence, usage, and cost, including nonzero exits.
• Use auto permission mode for headless lanes. Keep the existing read-only/workspace sandboxes and tool restrictions.

The local parser currently turns a synthetic cancellation into grok reported an error result. Upstream preserves its cancelled status and session ID.

Keep the bounded authentication retry, named dropouts, and explicit deadline. If the implementation needs retained streams from Sync 4, link that dependency before starting.

Sources:

• Authentication and parser changes, PR #130
• Headless permission change

Files: runner commands, preflight, result parsing, receipt handling, and their tests.

Done when

• The focused regression checks pass, along with bash scripts/check.sh.
• The exact candidate is installed and the changed behavior passes from each affected parent app. Record the version, action, and observed result in the PR. Keep it draft until that evidence is complete.