feat: add Grok Build click-tracking surface

[Atroci]

Acceptance criteria

Given a Grok Build checkout, problem-shaped requests about lost click IDs or attribution handoffs route to a read-only click-tracking-audit skill, the existing Claude plugin validates, and the plugin documents its local MCP and runtime boundaries without adding executable or telemetry surfaces.

What changed

• Add the problem-oriented click-tracking-audit skill with GCLID/GBRAID/WBRAID/FBCLID/MSCLKID, UTM, offline conversion, GA4/Ads, and CRM-handoff triggers.
• Document Grok Build's documented Claude compatibility and the manual checked-out stdio MCP setup.
• Keep the plugin MCP-free until @vizuh/clicktrail-mcp@0.2.0 is public; disclose the read-only npm metadata request boundary.
• Update manifest metadata and structural validation.

Verification

• python3 scripts/validate.py
• claude plugin validate . --strict
• git diff --check

Grok CLI runtime was not available in the validation environment, so runtime connection remains unverified. No xAI marketplace submission is included.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T18:02:07.489886Z	f5841a8	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-15T18:02:44.858856Z	f5841a8	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.