chore(acp): bump codebuddy, dimcode, dirac, grok, kilo and sigit registry pins to probed versions

[kaizhou-lab]

Summary

Scheduled ACP Registry version sync, covering three days of drift (the 2026-09-12 and 09-13 runs did not execute; the state file's last checked tag was v2026.09.10-797d203). Six npx pins drifted since #985, each backed by a fresh serial ACP probe of the exact pinned version. The diff is the lock file plus the one lock-derived test assertion that embeds codebuddy's version.

backend	package	old → new	initialize	session/new
codebuddy	@tencent-ai/codebuddy-code	2.148.0 → 2.150.0	ok (protocolVersion 1)	auth required (-32000, data.category: auth)
dimcode	dimcode	0.5.1 → 0.5.2	ok (agentInfo version 0.5.2)	auth required (-32000, "Provider credentials are required")
dirac	dirac-cli	0.5.11 → 0.5.12	ok (agentInfo dirac 0.5.12)	succeeded unauthenticated
grok	@xai-official/grok	1.0.27 → 1.0.30	ok (protocolVersion 1)	auth required (-32000, "no auth method id provided")
kilo	@kilocode/cli	7.6.0 → 7.6.2	ok (agentInfo Kilo 7.6.2)	succeeded unauthenticated
sigit	@smbcloud/sigit	1.5.7 → 1.5.8	ok (agentInfo sigit 1.5.8)	succeeded unauthenticated

All six meet the release-lock criterion: initialize succeeds, and session/new either succeeds or returns a clearly classified authentication requirement. Probes ran serially with no inherited HOME or credentials, and every entrypoint is unchanged from the previous snapshot. sigit carries skip_version_probe: true, which exempts only the runtime --version subprocess — it was still ACP-probed here.

A new agent was listed this window and is deliberately NOT in this PR. minimax-code (MiniMax Code, https://agent.minimax.io, npm @minimax-ai/code) brings the Registry to 41 ids and, unlike the two deferred binary-only agents, ships an npx distribution (@minimax-ai/code@0.2.7 acp). It was probed and passes the integration bar (initialize protocolVersion 1; session/new → -32000 "Authentication required: Run mcode login"). Its integration is a separate PR on its own branch so that this lock-only bump keeps its routine shape and stays eligible for the standing self-merge rule; the integration PR will reference this one.

Snapshot structural diff (against v2026.09.10-797d203): apart from the new minimax-code entry, every change is version churn — no distribution type added or removed on any existing agent, and args/env are byte-identical for every npx entry. Non-lock movement is report-only: factory-droid 0.218.1, plus new binary artifacts for cursor, harn, junie, kilo's binary channel, sigit's binary channel, and kimchi.

Derived assertion updated: registry_npx_lock.rs pins codebuddy's exact version inside a --package-form argument list, so it moves with the lock — 2.148.0 → 2.150.0. All six outgoing versions were scanned across crates/**/*.rs with fixed-string matching before staging; codebuddy's is the only real assertion and the other five have no hits. npx_cache_repair.rs keeps its own version literals: those are cache-path hash fixtures, not lock assertions.

The other 5 Registry-pinned packages (autohand, deepagents, glm-acp-agent, nova, pi) match the snapshot exactly. Drifted but not upgraded: none. mimo-code remains the one non-Registry builtin (no registry_json_id), excluded from drift reconciliation.

Standing watches (unchanged, no action here): kimchi stays deferred (binary-only, artifact moved again); sigit's npm scope rename (@smbcloud/sigit → @getsigit/sigit) is still only a vendor stderr notice and the Registry still declares the old scope.

Registry snapshot

• Audit pinned to release tag v2026.09.12-e6ee445 of agentclientprotocol/registry, fetched via the versioned CDN path for reproducibility.
• 41 ids in the raw snapshot: one newly listed agent (minimax-code, handled in a separate integration PR) and no delisted agents. (antigravity-acp and kimchi remain listed and deferred as binary-only; fast-agent and minion-code remain listed but uvx-only and therefore out of scope.)

Validation

• just migration-check — pass
• just lint-fix (cargo fix + clippy --fix --workspace -D warnings) — clean
• just fmt — clean
• Local cargo nextest intentionally skipped, by standing policy for lock-only bumps (established 2026-08-11). The Test check on this PR is the authority for this change: the merge decision depends on CI rather than the local run, and this host's load only manufactures timeout-shaped test failures, which nothing in the local steps above is subject to.

Logging

No logging changes: lock version bumps plus one test assertion; existing startup/session error paths already identify a failing agent by backend.