feat: lean Grok 1.0.34 broker worker with enforced tool, model and isolation policy

[apresmoi]

Summary

Runs Grok through the engine broker in its leanest form: fixed context drops from ~15k to ~2.5k input tokens per model request.

• Pin Grok CLI 1.0.34 (linux arm64/amd64 hashes in the contract manifest); proxy accepts only that client version.
• Compile the lean worker argv and a fixed ~140-token Daimon system prompt into the native launcher (no caller-controlled values); --max-turns backstop.
• Single worker config.toml renderer: bundled skills and workflows disabled, session-title request routed to the proxy and refused locally, closed model/effort list (default grok-4.6 / low), MCP registered in the Daimon-owned GROK_HOME. Config sha256 pinned per model×effort and verified before each turn.
• Proxy refuses, before any upstream spend: tool sets other than the exact lean six, undeclared model or effort, unknown top-level members, __proto__ keys; forwards only the canonical re-serialized body.
• Attestation for 1.0.34: events at $GROK_HOME/sessions/sandbox-events.jsonl, non-empty deny lists, per-turn lock-in of the first accepted ProfileApplied, guard awaited before the first upstream call; read-only root-owned worker home layout.
• Launcher: prompt fd survives exec for every fd numbering; worker fds exactly 0,1,2,3,4 with stdin /dev/null.
• Provider capability reaches the worker via env_key because Grok 1.0.34 never runs auth_provider helpers; tool children cannot reach the proxy (network seccomp) and the token dies at turn end.

Stacked on #24.

Verification

• Full npm test: 708 pass / 0 fail / 9 skipped (one timing-sensitive cliSession dispose test failed in 2 of 4 full runs under load; passes isolated and under CPU stress on both this branch and the base — tracked as a flake).
• Typecheck, build, verify:native, verify:contract-manifest pass.
• Mutation checks performed for every enforced property (red → green).
• Live zero-cost checks: real launcher + Grok 1.0.34 + bubblewrap in a Linux container against a stub model: 2 requests per turn, lean tools/model/effort/system prompt only, no AGENTS.md/skills injection, sandbox denied evaluator path reads.
• Three rounds of cross-vendor (Grok) adversarial review; all blocking findings fixed.

🤖 Generated with Claude Code