feat: grok docker.sock preflight, stall amnesty, 0.152 window (0.0.54)

[okisdev]

summary

• grok 1.0.13's strict sandbox refuses to start while /var/run/docker.sock is a symlink (the resting state with OrbStack or Docker Desktop on macOS), which killed every dispatch on such hosts in 50 to 90 seconds; the companion now lstats the upstream runtime-socket deny candidates before spawn and fails the dispatch as sandbox in seconds with the path and the host side repair, and /grok:setup reports the host state
• the stall detector no longer kills productive workers: a surfacing tool call refreshes liveness and proceeds, stall terminalizes only from sweep paths, stall budgets double to 600s for claude-worker and deep-reasoner, deep-reasoner's output cap doubles to 48k, and cancelled records keep the durable subagent transcript path
• settlement telemetry separates sizing from judgment: new oversized semantic kind for wind-down empty deliveries, new grok network failure kind (repeated breaker class), codex records carry fileChangeCount, and the worker ledger mirrors the engine failure kind into peerFailureKind
• the codex tested interval moves to [0.147.0, 0.153.0) for codex-cli 0.152.0, and verified versions, README, SECURITY, contract docs, and rules templates move to the 0.152.0 / 1.0.13 pair with the manifest regenerated

test plan

already verified

• npm test on the merged tree -> 1141 pass / 0 fail / 1 pre-existing skip
• per-package suites rerun in a full environment after sandboxed workers reported process-identity denials: grok family 170/170, codex family 268/268, task-lifecycle 29/29
• node plugins/grok/scripts/grok-companion.mjs setup on an OrbStack host -> "host environment: needs attention, runtime-socket deny path is a symlink: /var/run/docker.sock"
• node --test tests/plugin-versions.test.mjs tests/verified-versions.test.mjs after the lockstep bump -> 4/4

reviewer should verify

• on a host with a symlinked /var/run/docker.sock, a grok consult dispatch fails within seconds as sandbox naming the path, instead of dying after the sandbox handshake
• /codex:setup reports ready on codex-cli 0.152.0

notes

• the grok lane on an OrbStack host stays unusable until the symlink is gone (quit OrbStack or remove it); this PR makes the failure instant and actionable, the repair is host side, and upstream grok-build HEAD still hard-rejects symlink endpoints
• installed plugin caches keep running 0.0.53 until refreshed after this release