feat(signature): add Grok as a target-only provider family

xAI had no SignatureProvider value, so a Grok target could not be named
in a compatibility decision and fell through to the unknown-target
branch, which reports no compatible replacement rather than the correct
policy.

SignatureProviderGrok is deliberately target-only and
DetectSignatureProvider never returns it. xAI ciphertext carries no
envelope, no version byte and no fixed length, and is statistically
indistinguishable from uniform random bytes, so any positive detection
rule would also claim every other opaque high-entropy payload. Callers
establish an xAI target from the model or route, then use
InspectGrokEncryptedContent as a replay-safety shape check. A test
replays the native corpus to pin that detection keeps returning
unknown.

A Grok target drops the whole block when the signature does not match,
in contrast to Kimi: xAI decrypts encrypted_content on replay and
rejects foreign or mutated blobs with 400, so the block cannot survive
by shedding just its signature.

Also correct the recorded floor for MinGrokEncryptedContentDecodedLen.
The comment claimed the shortest observed native payload was exactly 50
bytes, which read like a protocol minimum; a later capture from
grok-4.5 and grok-composer-2.5-fast reached 43 and 48 bytes. The
observed minimum keeps sliding, which is the argument for keeping the
constant well below it and letting the entropy check filter. The value
is unchanged.