[P0][AGENT-06] Grok integration

Programme: #1
Epic: #20

## Objective
Integrate xAI/Grok's supported ACP/headless agent surface behind `AgentSession` with verified binaries, supported authentication and explicit capability differences.

## Scope
- Supported ACP/headless transport and provider-version pinning.
- Verify binary/source/version before execution.
- Supported auth flow without leaking credentials into prompts/project files.
- Normalize progress, permission requests, artifacts, errors, diagnostics and cancellation.
- Stage approved workspace only; enforce SEC-04 confinement/egress.
- Golden fixtures for provider errors, disconnects and capability negotiation.

## Product rules
- Do not parse interactive terminal paint as the primary supported integration.
- Unsupported provider operations are surfaced rather than approximated silently.
- Provider identity/inference location is visible when known.

## Acceptance criteria
- [ ] Shared bounded coding fixture runs through the supported structured path.
- [ ] Unsupported capabilities are reported explicitly.
- [ ] Provider process/session is stoppable and cannot dispatch after lease revocation.
- [ ] Only approved workspace/context is available to the provider process.
- [ ] Auth/binary/version failures produce deterministic diagnostics.
- [ ] Protocol drift is covered by golden fixtures.

## Dependencies
- AGENT-02

**First phase:** P0
**Maturity target:** P3
**Owner:** harness-pc-providers

Start by reviewing the AgentSession integration point and dependency AGENT-02, then map the supported structured provider path against the stated scope. Done means the bounded fixture works, unsupported capabilities and deterministic failures are surfaced, revocation stops dispatch, workspace access is confined, and protocol drift has golden-fixture coverage.

Written by the indexing model from the issue text.