Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-grok-pager-render/Cargo.toml

@@ -102,9 +102,12 @@ serial_test = { workspace = true }
 tempfile = { workspace = true }
 
 [features]
+# Exposes `#[cfg(test)]` test-only helpers (mock setters, test guards,
+# deterministic pinning) to downstream crates' test builds. Enabled by
+test-support = []
 # CI builds a single shared rlib variant per crate, so the pager's CI
 # test target links the same render lib as production. Enabling the test-only
 # helpers in the CI default set keeps them present for the pager test while
 # leaving cargo's `default` (and thus cargo production builds) without them.
 # The helpers are inert unless their mock setters are called.
-default-bazel = []
+default-bazel = ["test-support"]