~x-ai/grok-latest → B (2:3)

B fixes a core multi-user breakage by removing shared browser sentinel delegates (WEB_BROWSER_AGENT/INVITE_BROWSER_AGENT) and modeling PendingSession.agent as Option so human votes no longer AgentBind a single fake delegate; it updates auth, UI posts, authorship, types/CLI poll handling, and adds a two-user integration test. A is a real, lasting XSS harden (ammonia at render for body_html with unit tests) but is a narrower sanitize-at-boundary change versus B’s correct data-model and product-path fix.