chore(acp): bump glm, grok and nova registry pins to probed versions

[kaizhou-lab]

Registry snapshot

• Release tag: v2026.10.14-2bb9475
• CDN JSON: https://cdn.agentclientprotocol.com/registry/v1/v2026.10.14-2bb9475/registry.json
• Public page: https://agentclientprotocol.com/get-started/registry.md
• 42 agent ids in the CDN JSON (41 on the previous audited snapshot v2026.10.13-894756e); no delisted entries. The one new id (bob) is out of scope for this PR; see "New agent" below.

Version drift

backend	package	old	new
glm-acp-agent	glm-acp-agent	1.14.0	1.15.0
grok	@xai-official/grok	1.0.54	1.0.57
nova	@compass-ai/nova	1.1.52	1.1.53

The other Registry-pinned entries (autohand, codebuddy, deepagents, dimcode, dirac, kilo, minimax-code, pi, sigit) match the snapshot. mimo-code is a non-Registry builtin and is excluded from drift reconciliation.

Probe evidence

Each package was probed serially at the exact new version with the Registry's declared argv, no inherited HOME and no credentials. All three completed ACP initialize at protocolVersion 1.

backend	probed argv	session/new	classification
glm-acp-agent	npx -y glm-acp-agent@1.15.0	session created; modes default/accept_edits/bypass_permissions	success
grok	npx -y @xai-official/grok@1.0.57 agent stdio	-32000 "Authentication required", data "no auth method id provided"	auth required
nova	npx -y @compass-ai/nova@1.1.53 acp	-32000 "Click Nova Setup to configure your API keys", with kore-terminal-auth attached	config required

Drifted but not upgraded: none.

glm-acp-agent's seeded yolo_id is bypass_permissions (migration 025), and 1.15.0 still advertises that ACP session mode, so the stored value remains valid.

New agent (not part of this PR)

The CDN JSON now lists bob (IBM Bob, @ibm/bob@2.0.7, args acp). It is not integrated here:

• It does not yet appear on the public Registry page, which is the identity authority for integration. The page still has 41 cards and no IBM or Bob entry.
• With the Registry's declared argv, session/new fails with -32600 "Workspace … is not trusted. Pass --trust …". Supporting it needs a deliberate decision about passing --trust.

It has been recorded for follow-up rather than integrated, and this PR stays lock-only.

Structural diff

The previous snapshot (v2026.10.13-894756e) was fetched from its versioned CDN path and diffed per agent. For every existing npx entry whose package moved, args and env are byte-identical. Beyond the three pins above, the changes are the new bob entry and version churn in agents AionCore does not pin: claude-acp, cline, factory-droid, gemini, github-copilot-cli, and the junie binary. No distribution type was added or removed for any pinned backend.

Scope

Lock-only. A fixed-string scan (grep -rnF) for each outgoing version across crates/**/*.rs returned no match, so no lock-derived test assertion needed updating. The version literals in npx_cache_repair.rs are cache-path hash fixtures and are deliberately untouched.

Validation

• just migration-check: passed.
• just lint-fix (cargo fix + clippy --fix --workspace -D warnings): clean, no fixes produced.
• just fmt: clean.
• just _auto-commit-fixes: nothing to commit.
• Local cargo nextest run --workspace skipped by standing policy for a lock-only bump; the Test check on this PR is the authority.

Logging

No logging change. This is a resource-manifest version bump on an existing, already-instrumented spawn path.