Add Grok Build subscription provider via ACP (no XAI_API_KEY)

Summary

Add a first-class grok-build provider that drives Grok Build through the user's existing authenticated Grok CLI session over the Agent Client Protocol (ACP), without requiring XAI_API_KEY, and without changing the existing xai API-key provider.

Motivation

Users with a Grok Build subscription can authenticate through the installed grok CLI, but jcode currently only reaches xAI models via a raw XAI_API_KEY (the OpenAI-compatible xai provider). There is no way to spend a Grok Build subscription from jcode.

Proposal

• New provider id grok-build, selectable via --provider grok-build.
• Authentication delegated to the Grok CLI (grok login, browser OAuth or device-auth when headless). jcode never reads, copies, persists, or refreshes Grok OAuth credentials.
• Transport is ACP v1 over grok agent … stdio: initialize → authenticate (cached_token) → session/new/session/resume → session/prompt, translating session/update notifications into jcode stream events.
• Dynamic model discovery from the ACP initialize model state.
• Grok Build runs its own restricted internal ACP tool loop (isolated agent profile, minimal built-in coding tools, no MCP inheritance/skills/AGENTS.md/subagents); jcode keeps the outer session, provider, model routing, memory, swarm, and orchestration layers.

Distinction from the xai provider

Expected behavior / acceptance

With XAI_API_KEY unset:

• jcode auth-test --provider grok-build passes.
• jcode --provider grok-build run 'Reply exactly GROK_BUILD_OK' returns GROK_BUILD_OK.

With a deliberately invalid XAI_API_KEY:

• jcode --provider grok-build run 'Reply exactly SUBSCRIPTION_ONLY_OK' still succeeds (the subscription path is used, the API key is ignored).

Notes

A reference implementation is prepared on a fork branch and will be linked as a PR. Per CONTRIBUTING.md, it is offered as a reference/proof of concept for a maintainer-authored change.

Start with CONTRIBUTING.md and the ACP v1 entry points described in the issue: initialize, authenticate, session/new or session/resume, and session/prompt. Verify the acceptance commands with XAI_API_KEY unset and deliberately invalid, confirming auth-test passes and the exact GROK_BUILD_OK and SUBSCRIPTION_ONLY_OK responses are returned.