docs: finish the four-agent sweep, serve llms.txt on the docs site

- philosophy, how-it-works, troubleshooting: last three live-doc
  spots that still said three agents (devlogs and research docs are
  timestamped history — left alone)
- troubleshooting: grok's browser-less first login gets its own
  entry (device-auth or host-side auth + autolink)
- install.sh quick-start hint now offers grok too
- docs/llms.txt -> ../llms.txt symlink: mkdocs resolves it, so
  docs.deva.sh/llms.txt serves the canonical file — one source, no
  copy to rot

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: lroolle

docs/how-it-works.md

@@ -114,7 +114,7 @@ Persistent is default:
 
 - one default container shape per project
 - reused across runs
-- same workspace can run Claude, Codex, and Gemini in the same container when mounts, config, and auth line up
+- same workspace can run Claude, Codex, Gemini, and Grok in the same container when mounts, config, and auth line up
 - different volumes, explicit config homes, or auth modes create separate persistent containers
 
 Ephemeral with `--rm`:

docs/llms.txt

@@ -0,0 +1 @@
+../llms.txt

docs/philosophy.md

@@ -39,7 +39,7 @@ Persistent per-project containers mean:
 
 - warm package caches
 - stateful shell history and scratch space
-- fast switching between Claude, Codex, and Gemini
+- fast switching between Claude, Codex, Gemini, and Grok
 
 `--rm` still exists. It just is not the default because the default should serve real work instead of screenshots.
 

docs/troubleshooting.md

@@ -84,7 +84,7 @@ If the dry-run shape is correct but the agent still cannot authenticate, the wra
 
 Symptom:
 
-- first run warns that `.claude`, `.codex`, or `.gemini` is empty
+- first run warns that `.claude`, `.codex`, `.gemini`, or `.grok` is empty
 
 Meaning:
 
@@ -93,6 +93,22 @@ Meaning:
 
 That is not an error. That is exactly what isolated config homes are for.
 
+## Grok Wants A Browser The Container Does Not Have
+
+Symptom:
+
+- first `deva.sh grok` run tries to open a browser for OAuth and cannot
+
+Fix, either one:
+
+- run `grok login --device-auth` inside the session — it prints a URL and
+  a code you complete on any device
+- authenticate once on the host; deva's autolink carries
+  `~/.grok/auth.json` into the container
+
+Details, including api-key mode and why in-container `grok update`
+cannot touch your host install: [Authentication](authentication.md).
+
 ## Proxy Weirdness
 
 Deva rewrites `localhost` in `HTTP_PROXY` and `HTTPS_PROXY` to `host.docker.internal` for the container path.

install.sh

@@ -149,6 +149,7 @@ echo "  3. Run one of:"
 echo "     deva.sh codex"
 echo "     deva.sh claude -- --help"
 echo "     deva.sh gemini -- --help"
+echo "     deva.sh grok -- --help"
 echo "     deva.sh shell"
 echo ""
 echo "warning: do not point deva at your real home directory with dangerous permissions enabled"