docs(sandbox-lint): declare Grok harness support

docs/vendor-neutrality.md

@@ -640,7 +640,7 @@ Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 63.
 | `release-config` | release | any | ✅ agnostic |
 | `release-verify` | release | any | ✅ agnostic |
 | `reproducible-archive` | release | any | ✅ agnostic |
-| `sandbox-lint` | sandbox | Claude Code, Codex, Cursor, Gemini CLI, Kiro, OpenCode | ✅ portable |
+| `sandbox-lint` | sandbox | Claude Code, Codex, Cursor, Gemini CLI, Grok, Kiro, OpenCode | ✅ portable |
 | `security-tracker-stats-dashboard` | analytics | any | ✅ agnostic |
 | `setup-preflight` | setup | any | ✅ agnostic |
 | `skill-and-tool-validator` | framework-dev | any | ✅ agnostic |
@@ -662,7 +662,7 @@ Harness → substrate tools it supports:
 - **Copilot** (1): `agent-guard`
 - **Cursor** (2): `sandbox-lint`, `spec-loop`
 - **Gemini CLI** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
-- **Grok** (2): `agent-guard`, `spec-loop`
+- **Grok** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
 - **Kiro** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
 - **OpenCode** (3): `agent-guard`, `sandbox-lint`, `spec-loop`
 - **any harness** (29): `adversarial-review`, `agent-isolation`, `container-gateway`, `contributor-metrics`, `dashboard-generator`, `dev`, `egress-gateway`, `maven-artifact-verify`, `permission-audit`, `pilot-report-validator`, `pr-management`, `preflight-audit`, `privacy-llm`, `probe-templates`, `release-config`, `release-verify`, `reproducible-archive`, `security-tracker-stats-dashboard`, `setup-preflight`, `skill-and-tool-validator`, `skill-evals`, `skill-reconciler-diff`, `skill-token-count`, `spec-inventory`, `spec-status-index`, `spec-validator`, `symlink-lint`, `vendor-neutrality-score`, `vetted-ops`

tools/sandbox-lint/README.md

@@ -23,7 +23,7 @@
 
 **Capability:** substrate:sandbox
 
-**Harness:** Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Kiro
+**Harness:** Claude Code, Codex, Cursor, Gemini CLI, OpenCode, Kiro, Grok
 
 Lints `.claude/settings.json` against the shipped baseline at
 `tools/sandbox-lint/expected.json`, and against the security
@@ -93,7 +93,7 @@ uv run --project tools/sandbox-lint sandbox-lint --gemini .gemini
 The ordinary regression suite needs no Gemini or Node installation.
 Optional [runtime integration tests](tests/integration/README.md) exercise Gemini's policy engine and Linux sandbox without a model.
 
-**Any other harness (Cursor, …).** `--any-harness`
+**Harnesses without a dedicated config profile (Cursor, Grok, …).** `--any-harness`
 validates the harness-neutral OS-level security posture: checks that the
 two enforcement components shared across all runtimes —
 `tools/agent-isolation/agent-iso.sh` (layer 0, clean-env credential strip)
@@ -181,7 +181,7 @@ baseline drift.
 ## Harness-neutral posture check (any runtime)
 
 For runtimes that do not expose a per-harness sandbox configuration file
-(Cursor and any other agent harness not listed under
+(Cursor, Grok, and any other agent harness not listed under
 `--settings`, `--opencode`, `--kiro`, `--codex`, or `--gemini`), the security posture
 is enforced at the OS level by two harness-agnostic components:
 

tools/sandbox-lint/src/sandbox_lint/__init__.py

@@ -456,7 +456,7 @@ def _lint_any_harness(framework_root: Path | None) -> int:
     ``tools/agent-isolation/`` (layer 0, clean-env wrapper) and
     ``tools/agent-guard/`` (layer 3, action guard) — are present in the
     framework tree. This is the posture check for runtimes that do not have a
-    dedicated per-harness config mode here (Cursor, …).
+    dedicated per-harness config mode here (Cursor, Grok, …).
     """
     from sandbox_lint.posture import PostureViolation, check_posture_violations, find_framework_root
 
@@ -474,7 +474,7 @@ def _lint_any_harness(framework_root: Path | None) -> int:
         return 0
     print(
         f"sandbox-lint: harness-neutral posture violations at {root} —\n"
-        "  For runtimes without a dedicated config mode (Cursor, …)\n"
+        "  For runtimes without a dedicated config mode (Cursor, Grok, …)\n"
         "  the security posture is enforced by these OS-level components:",
         file=sys.stderr,
     )
@@ -576,7 +576,7 @@ def main(argv: list[str] | None = None) -> int:
         metavar="FRAMEWORK_ROOT",
         help=(
             "Validate the harness-neutral security posture for runtimes without "
-            "a dedicated settings file (Cursor, …). "
+            "a dedicated settings file (Cursor, Grok, …). "
             "Checks that the OS-level enforcement components (agent-isolation "
             "layer-0 clean-env wrapper and agent-guard layer-3 action guard) "
             "are present. Optionally supply the framework root directory; "

tools/sandbox-lint/src/sandbox_lint/posture.py

@@ -18,7 +18,7 @@
 """Harness-neutral security-posture check for sandbox-lint.
 
 For agentic harnesses that do not have a dedicated sandbox configuration file
-(Cursor, Gemini CLI, and others), the security posture comes from
+(Cursor, Grok, and others), the security posture comes from
 OS-level enforcement components shared across all harnesses. This module
 validates that those components are present in the framework tree so the
 security posture holds regardless of which harness drives the session.