fix(grok-cli): complete Responses compatibility codec

[ryanngit]

Supersedes #2590. That PR was closed as merged, but master still points to v0.5.30 and does not contain its commits. This branch retains that reviewed protocol work and adds the complete source-pinned Responses compatibility layer.

Summary

• Align Grok CLI subscription traffic with official @xai-official/grok wire behavior while keeping grok-cli, xai, and grok-web provider boundaries separate.
• Add proxy-aware live model discovery, current billing/quota parsing, model-aware reasoning, and official inference identity headers.
• Translate cross-provider OpenAI/Codex Responses history into Grok-representable wire without mutating client input.
• Preserve native encrypted Grok reasoning and backend-tool history; convert custom tools/history to function calls.
• Repair malformed arguments, duplicate/orphan/dangling call-output pairs, stale tool choices, and structured outputs deterministically.
• Return unsupported semantic input locally as HTTP 400; unmatched provider HTTP 400/422 no longer locks or rotates accounts.
• Keep successful provider SSE passthrough unchanged.
• Generate stable per-account agent IDs and preserve them across concurrent account retries.
• Parse current creditUsagePercent, percentage-only quota, and legacy used billing shapes.

Compatibility codec is based on xai-org/grok-build commit b189869b7755d2b482969acf6c92da3ecfeffd36. Client fingerprint remains exact proven @xai-official/grok 0.2.99 wire capture; Cargo workspace versioning is a separate track.

Validation

• Focused public matrix: 78/78 tests passed across Grok codec, executor, models, quota, fallback, OAuth probe, and Responses multi-turn files.
• Production build passed Next.js compilation, TypeScript, and 126 routes.
• Focused ESLint: 0 errors; one existing anonymous-default-export warning.
• git diff --check and private-data leak scan passed.
• Full unit run: 954 passed, 24 skipped, 26 unchanged baseline failures outside this PR's changed files.
• Independent review found no remaining actionable findings after red-green fixes for current billing fields, account identity isolation, duplicate calls, nested semantic loss, and malformed input containers.
• Isolated and promoted canaries returned HTTP 200 for minimal Grok 4.5 and large cross-provider history; malformed semantic input returned local HTTP 400 before transport.
• 1,088,882-byte/463-item history, native x-search replay, web search, function/custom history, JSON schema, and two-way streaming concurrency completed successfully.

Private model aliases, proxy pools/ports, credentials, local DB state, deployment scripts, verifier, ledger, and runbook are intentionally excluded.