Add xAI Grok 4.5 provider

[apcar]

What changed

• Adds xAI's Grok 4.5 as a fifth live CouncilLogic provider through the Responses API.
• Adds the api.x.ai destination allowlist, XAI_API_KEY logical secret name, xai-grok lineage, factory wiring, structured jury parsing, provider-reported cost metadata, and ZDR response metadata.
• Keeps existing file-backed four-provider configurations unchanged unless they explicitly add [providers.xai].
• Updates the example configuration and public documentation for the five-provider, eleven-call live topology.
• Leaves the mock-only service frozen at its documented four-lineage, nine-call reference topology.

Why

CouncilLogic should include Grok as an additional independently operated model lineage without distributing or committing the operator's API credential.

User impact

New no-config defaults and the updated example include xAI/Grok. Existing file-backed configurations remain four-provider until explicitly opted in. Credentials continue to resolve only from the environment or an external secret command; no credential value is stored in the repository or run configuration.

Validation

• 101 unit tests passed.
• Source, tests, and scripts compiled successfully.
• git diff --check passed.
• Staged-tree secret-pattern scan found no API-key-shaped value.
• A synthetic Grok-only live canary completed proposal, jury, and synthesis with grok-4.5; provider-reported cost metadata was present for all three calls and no key-shaped value appeared in its audit store.