Community provider for the official Grok Build CLI

Problem

Archon can run workflows on Claude, Codex, Pi, OpenCode, and GitHub Copilot. There is no provider: grok path that drives the official Grok Build CLI (grok) with a SuperGrok / grok.com subscription. Operators who already authenticate with grok login cannot use that subscription inside Archon DAGs.

Pi's xai/<model> HTTP backend is a different product: API-key traffic, not the Grok Build CLI, and not SuperGrok OAuth.

Why

Grok Build is a first-class coding agent with headless streaming-json, native session UUIDs, --json-schema, and --reasoning-effort. Users who already pay for SuperGrok should be able to set provider: grok the same way they set provider: copilot or provider: pi.

Desired outcome

Vanilla Archon accepts provider: grok as a bundled community provider (builtIn: false). A workflow node with that provider spawns the official grok CLI in headless mode, bills the SuperGrok / grok.com OAuth session in ~/.grok/auth.json, and streams MessageChunks back to the DAG executor.

Acceptance

• registerCommunityProviders() registers grok with builtIn: false
• archon workflow run with provider: grok / model: grok-4.6 completes a one-node prompt
• Auth is SuperGrok OAuth (grok login). XAI_API_KEY / GROK_CODE_XAI_API_KEY / GROK_API_KEY are stripped from the child and GROK_DISABLE_API_KEY_AUTH=1 is set
• This is not Pi xai/... and not an API-key path
• Capabilities are honest for v1: resume, env injection, effort, enforced structured output on; MCP, YAML skills:, hooks, sandbox, cost caps off
• Capability matrix and AI Assistants docs include Grok

Constraints and related work

• Must remain true: community-provider contract from https://github.com/coleam00/Archon/pull/1195 (builtIn: false, one directory under packages/providers/src/community/, one line in registerCommunityProviders(), no AssistantDefaultsConfig slot)
• Scope boundary: no builtIn: true, no archon ai login vendor for xAI, no MCP/skills/sandbox translation in v1
• Related issues or PRs: https://github.com/coleam00/Archon/issues/2525 (Pi / Cursor slug cursor-grok-4.5, not the Grok CLI); https://github.com/coleam00/Archon/pull/1505 (Copilot community provider pattern); closed https://github.com/coleam00/Archon/pull/231 (pre-rewrite Python RAG GROK_API_KEY)
• Solution steering: Requirement — spawn official grok with --output-format streaming-json, --oauth, --permission-mode bypassPermissions (Claude's always-approve analog). Do not use --yolo / --worktree. Resume only with a native session UUID.

Additional notes

Grok is not bundled with Archon. Binary resolution: GROK_BIN_PATH, assistants.grok.grokBinaryPath, ~/.archon/vendor/grok/, well-known install paths, then PATH.