Synced from monorepo

Changes:
- grok-shell: request workspaces:read/write OAuth2 scopes
- security: fix SSRF bypass via HTTP redirect in hook runner
- fix(grok-build): enterprise STT WSS URL + API-key voice bearer
- Harden identity-change purge and sync-marker invariants
- sandbox + workspace-server: delete the legacy ready-file arm
- Show billing URL when browser cannot open
- fix(pager): show folder-trust UI in minimal mode
- fix(pager): drain task_backgrounded before no-wait headless exit
- grok-agent-sdk: stop SDK-spawned agents from staging self-updates they can never adopt
- Split settings_modal into directory module
- Delegate VS Code SSH file links
- grok-shell: release the workspace session binding when a session is removed
- keep skills reachable when their name collides with a client builtin
- Preserve semantic link targets

crates/codegen/xai-grok-shell-base/Cargo.toml

@@ -6,9 +6,10 @@ edition.workspace = true
 description = "Foundation modules for the grok shell crate family: environment presets, CPU profiling, and process/filesystem utilities."
 
 [features]
-# CI default set: builds a single shared rlib per crate, so downstream test
-# targets need the test-only helper surface compiled in.
-default-bazel = []
+# Exposes `#[cfg(test)]`-only helpers (`env::EnvVarGuard`,
+# `cpu_profile` test seams) to downstream crates' test targets. Enabled by
+test-support = ["xai-grok-env/test-support"]
+default-bazel = ["test-support"]
 
 [dependencies]
 anyhow = { workspace = true }
@@ -41,7 +42,7 @@ windows = { workspace = true }
 tempfile = { workspace = true }
 # `cfg(test)` in this crate does not enable features on dependencies, so the
 # tests' `EnvVarGuard` re-export needs the feature turned on explicitly.
-xai-grok-env = { workspace = true, features = [] }
+xai-grok-env = { workspace = true, features = ["test-support"] }
 
 [lints]
 workspace = true