chore(acp): bump dirac, grok, nova and pi registry pins to probed versions

[kaizhou-lab]

Summary

Scheduled ACP Registry version sync. Four npx pins drifted since #728; each bump is backed by a fresh serial ACP probe of the exact pinned version. Lock-only change plus the three lock-derived test assertions that embed pi's version — no metadata, migration or entrypoint edits.

backend	package	old → new	initialize	session/new
dirac	dirac-cli	0.4.29 → 0.4.31	ok (agentInfo dirac 0.4.31)	success (modes plan/act)
grok	@xai-official/grok	0.2.116 → 0.2.117	ok (protocolVersion 1)	auth required (-32000, "no auth method id provided")
nova	@compass-ai/nova	1.1.29 → 1.1.30	ok (protocolVersion 1)	config required (-32000, "Click Nova Setup to configure your API keys", advertising a kore-terminal-auth terminal method)
pi	pi-acp	0.0.32 → 0.0.33	ok (agentInfo pi-acp "pi ACP adapter" 0.0.33)	auth required (-32000, advertising pi_terminal_login)

All four meet the release-lock criterion: initialize succeeds and session/new either succeeds or returns a clearly classified authentication/configuration requirement. Probes ran serially (cold npx downloads contend and produce false timeouts when parallelised), with no inherited HOME or credentials.

The other 7 Registry-pinned packages (autohand, codebuddy, deepagents, dimcode, glm-acp-agent, kilo, sigit) match the snapshot exactly — no drift. Package names and entrypoint args are unchanged for all 11. Drifted but not upgraded: none. The mimo-code and omp entries are non-Registry builtins (no registry_json_id) and are correctly excluded from drift reconciliation.

Observation, not a blocker: nova 1.1.30 self-reports agentInfo.name = "kore-cli", version = "1.0.0" — neither matches the product name nor the package version. The Registry/public-page identity (Nova by Compass AI) and the package are unchanged, and initialize succeeded, so the pin is still evidenced; recorded here in case the vendor's identity fields matter to a later audit.

Registry snapshot

• Audit pinned to release tag v2026.07.31-19e2d4c of agentclientprotocol/registry (newest release at audit time), fetched via the versioned CDN path for reproducibility.
• No newly listed and no delisted agents versus the previous baseline (38 ids).

Validation

• cargo test -p aionui-runtime -p aionui-ai-agent — pass
• Full just push gate (migration check, lint, fmt, cargo nextest run --workspace) — pass
• Gate run with the host-injected AIONUI_LOG_DIR unset (pre-existing environment sensitivity, see chore(acp): bump registry npx lock to probed versions #695)
• Updated the three lock-derived assertions that pin pi's version (registry_npx_lock.rs, factory/acp.rs, services/availability/mod.rs). npx_cache_repair.rs keeps its pi-acp@0.0.31 fixture literal: it exercises cache-path construction, not the release lock.

Logging

No logging changes: lock-only version bumps; existing startup/session error paths already identify a failing agent by backend.