~x-ai/grok-latest → B (3:2)

B fixes a core multi-user breakage: a shared WEB_BROWSER_AGENT sentinel bound on the first browser vote and blocked later humans with AgentBound, by making PendingSession.agent optional and posting browser votes with no delegate, plus a two-user integration test. A’s fail-closed resolve_vote_actor, mock-OAuth gate, Secure cookies, and return_to hardening are real security wins, but they refine an existing auth path rather than removing a flawed design that stopped the product’s main multi-user flow.