docs(sandbox-lint): declare Grok harness support

[KatalKavya96]

Summary

• Declare Grok as supported by tools/sandbox-lint through the existing harness-neutral --any-harness posture check.
• Update sandbox-lint documentation and CLI/help wording so Grok is explicitly identified alongside other runtimes without a dedicated sandbox config profile.
• Regenerate vendor-neutrality metadata so the declared harness support matches the existing implementation.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other: harness metadata / sandbox-lint posture documentation alignment

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other:
  • uv run --project tools/sandbox-lint --group dev pytest tools/sandbox-lint/tests/test_posture.py
  • existing --any-harness coverage verifies complete, incomplete, missing, and auto-detected framework posture cases
  • vendor-neutrality metadata regenerated successfully

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new sandbox behavior or unrestricted host access is introduced; Grok uses the existing harness-neutral --any-harness posture check
• Vendor neutrality — Grok is represented through the existing generic harness-neutral path rather than a vendor-specific sandbox implementation
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — no autonomous outbound messages; drafts only, sent on confirmation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Refs #1416

Notes for reviewers (optional)

This PR does not add a Grok-specific sandbox parser or new security logic.

sandbox-lint already supports runtimes without a dedicated config profile through --any-harness, which verifies the presence of the shared harness-neutral enforcement components:

• tools/agent-isolation/agent-iso.sh
• tools/agent-guard/ dispatch core

Grok already relies on that same external OS-level posture, so this change makes the existing support explicit in the harness declaration, documentation, CLI/help wording, and generated vendor-neutrality metadata.

No Grok-specific regression test was added because the generic --any-harness behavior is already covered directly by the existing posture test suite.

[KatalKavya96]

@potiuk This should be the final cleanup slice for #1416.
Grok support is now covered across the issue’s planned integration points:

• feat(setup): recognize Grok as a universal skill reader #1488 — universal skill loading / setup support
• feat(agent-guard): add Grok PreToolUse integration #1516 — Grok PreToolUse action-guard integration
• feat(spec-loop): add Grok headless harness profile #1593 — Grok headless spec-loop profile
• feat(tools/adversarial-review): add grok reviewer backend #1446 — Grok adversarial-review backend + privacy-LLM opt-in documentation
• this PR — final sandbox-lint harness declaration and --any-harness posture documentation alignment
  This PR does not add new sandbox logic; it just makes Grok’s use of the existing harness-neutral posture path explicit and keeps vendor-neutrality metadata in sync.
  Full prek run --all-files passes locally.

[Kaap10]

LGTM!

Thank you @KatalKavya96 for wrapping up the Grok harness documentation and metadata alignment for #1416.

• Declaring Grok under --any-harness accurately reflects that Grok relies on the shared OS-level posture enforcement components (agent-iso.sh and agent-guard) rather than a dedicated sandbox profile.
• Updating tools/sandbox-lint/src/sandbox_lint/posture.py also nicely cleans up the stale reference to Gemini CLI.
• Verified locally: all posture tests, mypy, and ruff checks pass cleanly, and all 11 CI checks are green.

One minor non-blocking editorial nit: in tools/sandbox-lint/README.md (line 26), Grok was appended at the end (..., OpenCode, Kiro, Grok), whereas the generated vendor-neutrality table sorts it alphabetically (..., Gemini CLI, Grok, Kiro, OpenCode). Feel free to adjust if you touch the file again.

[Kaap10]

Suggested change

	**Harness:** Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Kiro, Grok
	**Harness:** Claude Code, Codex, Cursor, Gemini CLI, Grok, Kiro, OpenCode

(Nit, non-blocking): Kept in alphabetical order to match the generated table in docs/vendor-neutrality.md.