fix(grok): fence project permission settings and extend qualification

tests/runner-e2e/catalog.test.ts

@@ -71,10 +71,10 @@ describe("runner E2E catalog", () => {
     expect(localIntegrityTasks).toHaveLength(2);
     expect(openRouterBreadthTasks).toHaveLength(3);
     expect(runnerSuites.map((suite) => suite.expectedMatrixSize)).toEqual([
-      10, 23, 38, 52, 28, 18, 6, 6, 48, 16, 10, 2,
+      16, 23, 38, 52, 28, 18, 6, 6, 48, 16, 10, 2,
     ]);
-    expect(validateRunnerCatalog()).toHaveLength(257);
-    expect(new Set(runnerMatrix.map((entry) => entry.id)).size).toBe(257);
+    expect(validateRunnerCatalog()).toHaveLength(263);
+    expect(new Set(runnerMatrix.map((entry) => entry.id)).size).toBe(263);
     expect(
       runnerMatrix.filter((entry) => entry.suite.id === "core-compatibility"),
     ).toHaveLength(48);
@@ -550,6 +550,16 @@ describe("runner E2E selectors", () => {
     ]);
   });
 
+  it("keeps Grok artifact and stop/resume qualification explicit in both environments", () => {
+    const selected = selectRunnerExecutions(parseRunnerSelectors(["--suite", "grok-qualification"]));
+    expect(selected).toHaveLength(16);
+    for (const environment of ["local", "daytona"]) {
+      for (const task of ["build-revise", "stop-new-resume", "continuity-restart"]) {
+        expect(selected.some(execution => execution.id === `grok-qualification.runner-acpx-grok.${environment}.${task}`)).toBe(true);
+      }
+    }
+  });
+
   it("selects a suite without exploding its environment matrix", () => {
     const selected = selectRunnerExecutions(
       parseRunnerSelectors(["--suite", "openrouter-model-breadth"]),

tests/runner-e2e/catalog.ts

@@ -919,12 +919,16 @@ const everydayProfiles = [
 export const runnerSuites: readonly RunnerSuiteFixture[] = [
   {
     id: "grok-qualification", label: "Grok Build Qualification", manualOnly: true,
-    description: "Grok task replies, planning approval, questions and controller restart in local and Daytona environments.",
+    description: "Grok replies, planning approval, questions, downloadable artifacts, stop/resume and controller restart in local and Daytona environments.",
     groups: ["native"],
     profiles: runnerProfiles.filter(profile => profile.id === "runner-acpx-grok"),
     environments: [localEnvironment, daytonaWarmEnvironment],
-    tasks: [...runnerTasks, ...localIntegrityTasks], expectedMatrixSize: 10,
-    definitionMetadata: { version: 1, binary: "1.0.13", model: "grok-4.7", scheduling: "explicit-only", repetitionsRequired: 3 },
+    tasks: [
+      ...runnerTasks, ...localIntegrityTasks,
+      ...everydayTasks.filter(task => task.id === "build-revise"),
+      ...chatHardeningTasks.filter(task => ["stop-new-resume", "continuity-restart"].includes(task.id)),
+    ], expectedMatrixSize: 16,
+    definitionMetadata: { version: 2, binary: "1.0.13", model: "grok-4.7", scheduling: "explicit-only", repetitionsRequired: 3, artifactOracle: "independent-python-contract", stopBoundary: "provider-turn-started" },
   },
   {
     id: "continuation", label: "Task continuation",