fix grok-implementer permission-mode from acceptEdits to auto

[tobetchi]

Summary

• Grok CLI 0.2.93 does not auto-approve write tool calls with --permission-mode acceptEdits, causing writes to be canceled
• Falls back to --permission-mode auto, which works

Test plan

• Ran grok-implementer with --permission-mode auto and confirmed writes succeed

[abullaisi]

Confirming this fix with independent test evidence, plus two doc lines the diff leaves behind.

Evidence for the flag change: ran the agent's exact invocation on a fixture repo — with acceptEdits headless: exit 0, grok announces the implementation, but git diff is empty (silent no-op). Same spec with auto: correct 43-line diff matching precomputed ground truth. Reproduced on grok CLI 0.2.14 and again on 0.2.101 (stable), so it's persistent CLI semantics, not a regression (details in #3).

Two leftover lines that will contradict the command after this merges:

1. The flag-discipline table (line ~70) still documents --permission-mode acceptEdits with its old rationale. Suggested row:

   | `--permission-mode auto` | Required headless: `acceptEdits` is a silent no-op in headless mode (exit 0, empty diff — #3). `auto` approves grok's tool calls; still never `--always-approve` — you re-run verification yourself. |
   

2. The verification step (line ~77) still says "(acceptEdits may have blocked grok from running the verification itself — your re-run covers that by design.)" — with auto, grok can run verification, so the rationale shifts: "(Even when grok runs the verification itself, its output is a claim — your re-run is the evidence.)"

Optional hardening from the same test: a post-run guard that catches this whole failure class regardless of future flag semantics — if git diff is empty while grok's final message claims an implementation, report STATUS: anomaly instead of proceeding. That check is what exposed the no-op in my repro.

Happy to send these as a follow-up PR on top of this one if that's easier.