Add Grok Build CLI agent backend

[ayush-that]

What changed

Adds --agent grok, a first-class backend that spawns the open-source Grok Build CLI grok -p --output-format json for process, revalidate, and setup. Wires registry, preflight via XAI_API_KEY or grok login, model route, isolated GROK_HOME, and docs. Sandbox path stays unsupported for this agent with a clear early exit.

Closes #151

Why

Grok is already a recommended model on the pi path. This is different. People who run Grok Build as their coding agent need a CLI harness, same shape as Codex/Claude, not another pi provider.

Verification

• pnpm test passes
• pnpm lint passes
• pnpm knip passes
• Processed production scan candidates with --agent grok, hundreds of findings across real repos
• If this adds a matcher, n/a

Notes for reviewer

• Not "add Grok models." Those already work via pi + xai/*. This is the Grok Build CLI agent.
• Headless contract is grok -p, JSON output, tool allowlist, env allowlist, abort on kill.
• Auth is XAI_API_KEY or existing grok login session. Preflight checks both.
• Vercel Sandbox is intentionally unsupported for now. No grok binary or key brokering in the sandbox image. Local process path is the supported one.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[vercel]

@ayush-that is attempting to deploy a commit to the Vercel Labs Team on Vercel.

A member of the Team first needs to authorize it.