Fix forward #284: Grok reflect destination, Grok live-gate reach, empty GROK_HOME #285

Introduced by: #284

The merged head's Unfret review (0d0c5d5) raised four findings that babysit-pr classed verdict-changing. This issue covers their fix-forward PR.

Acceptance criteria

1. Reflect has a Grok destination. plugins/pstack/skills/poteto-mode/references/codex-tools.md, section "Reflect skill copies", gains a Grok row. Project: .grok/skills/<skill>/. User: <config-home>/skills/<skill>/. These are Grok's own skill discovery folders (Grok user guide, 08-skills). Finding v1:1c735e4d.

2. Grok verification reaches Grok's runtime paths. In .claude/skills/verify-open-pstack/scripts/core.ts, GROK_REACH['grok:dispatch'] includes:

   • plugins/pstack/grok-agents/poteto-agent.md and plugins/pstack/grok-agents/comment-sicko.md
   • plugins/pstack/skills/poteto-mode/scripts/runner/types.ts
   • plugins/pstack/skills/poteto-mode/scripts/runner/registry/index.ts
   • plugins/pstack/skills/poteto-mode/scripts/runner/registry/render.ts
   • plugins/pstack/skills/poteto-mode/references/model-catalog.md
   • plugins/pstack/skills/poteto-mode/SKILL.md

   A classification test shows that each path reaches grok:dispatch. Findings v1:1f3cdb66 and v1:ccdebf5c.

3. An empty GROK_HOME resolves to the default. The fallback is ${GROK_HOME:-$HOME/.grok}, so an empty GROK_HOME means $HOME/.grok. This applies in scripts/isolation.ts (the setup snapshot), scripts/harness.ts (the case config home) and scripts/grok.ts (the session records). A test shows that the snapshot path with GROK_HOME="" is $HOME/.grok/rules/pstack-models.md. Finding v1:21c02ebc.

Not in scope

These were classed inert or fails-loudly, and their dispositions are recorded on #284:

• cancellation before a Grok spawn;
• deployment-key login in the doctor;
• UTF-8 chunk decoding;
• the two advisories.