Synced from monorepo

Changes:
- Persist submitter identity for /feedback
- Let custom models use rotating tokens from named auth providers
- Template stale tool/param name literals in server-native descriptions
- Minimal mode commits thinking in full, lookups as one-liners
- Tighten durable append internals
- Nudge model to end turn on no-op bash commands
- Per-fetch signing nonce in the managed-config envelope, with a server-side replay probe
- Include working tree in startup status

crates/codegen/xai-grok-workspace/src/permission/resolution.rs

@@ -2480,7 +2480,8 @@ mod tests {
         let (entries, logs) = parse_mcp_entries_capturing_logs(&json, "deniedMcpServers");
         assert_eq!(entries.len(), 1);
         assert!(
-            matches!(&entries[0], AllowedMcpServer::Name { name } if name == "internal-only"),
+            matches!(&entries[0], AllowedMcpServer::Name { name }
+if name == "internal-only"),
             "expected a Name entry, got {entries:?}"
         );
         assert!(

crates/codegen/xai-grok-workspace/src/permission/types.rs

@@ -534,7 +534,8 @@ mod tests {
         });
         let access = AccessKind::from(&input);
         assert!(
-            matches!(access, AccessKind::MCPTool { ref name, ref input } if name ==
+            matches!(access, AccessKind::MCPTool { ref name, ref input }
+if name ==
             "linear__save_issue" && input["title"] == "test"),
             "UseTool should produce AccessKind::MCPTool carrying the inner tool name and args, got {access:?}"
         );