Feat/telegram allowlist

[a348163124]

What does this PR do?

Type of change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• Other (describe below)

Checklist

• pnpm run build passes
• pnpm run test passes
• New code has tests (if applicable)
• Updated documentation (if applicable)

[0xranx]

Thanks for the contribution. I don't think we should merge this as-is yet:

• This PR mixes two unrelated changes: Telegram allowlist and a full Grok engine integration. Please split them into separate PRs.
• pnpm test currently fails in the new Telegram test because the mocked Bot is not constructable.
• injectGrokSkills() removes an existing same-name skill directory before linking, which can delete user files.
• writeGrokMcpConfig() overwrites the whole .grok/config.toml, which can remove existing project MCP/config entries.
• For headless Grok, please use the documented --no-auto-update flag. XAI_API_BASE_URL also does not appear to be supported by the current Grok CLI, so custom providers need to use Grok's model config instead.

The Telegram allowlist itself looks reasonable and should be quick to merge once split out, tested, and documented. The Grok integration needs the config/skill preservation fixes plus a real CLI E2E result.