feat(runtime): add Grok subscriptions and preserve transcript timestamps

[rynfar]

Grok subscription login now uses device OAuth and the subscription Responses API, with API-key switch-back, model refresh, encrypted reasoning and interleaved tool calls preserved. Custom messages also retain their original timestamps across persistence and compaction, preventing rebuilt sessions from changing transcript identity.

This combines the reviewed #74 Grok changes with the #76 timestamp fix, preserving both commit histories. Fixes #68. Fixes #76. It is the final source batch for pylon-code/pylon#557; merge this top-of-stack PR after exact-head CI so #74 does not require another serial integration cycle.

The timestamp fix covers all eight AgentSession persistence sites and rejects invalid explicit timestamps before mutation. Existing histories whose timestamps already differ remain unproved. No history rewrite, daemon protocol or artifact recipe changes. Pylon maintenance routing, scoped authentication and stock fallback remain intact.

Validation: the combined production files match the previously reviewed integration tree. Grok/auth/provider integration passed 664 focused tests, and timestamp/compaction integration passed 107 tests; six credential-dependent live-model cases were skipped and no paid providers ran. The final ancestry update changes no files. Required repository checks pass; final hosted CI is required.

Maintainer authorization: the developer requested review, fixes and merging this batch, then confirmed “ok lets finsh it.”

Implemented and reviewed with GPT-6 Astra in Pylon/Codex.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}