Set up CraftBukkit-style patch workflow for xai-org/grok-build

Upstream is a periodic one-way export of xAI's monorepo (linear
"Synced from monorepo" commits, SOURCE_REV pinning the internal SHA)
and explicitly refuses external contributions. So local changes can
never be upstreamed, and upstream re-drops the whole tree on every
sync -- structurally the same problem CraftBukkit has with Mojang.

Adopt the Spigot/BuildTools model: patches/ is the source of truth,
work/ is a disposable build artifact regenerated from upstream.rev
plus patches/.

  scripts/apply-patches.sh    ~ applyPatches.sh
  scripts/rebuild-patches.sh  ~ rebuildPatches.sh
  scripts/update-upstream.sh  forward-ports patches onto a new sync
  scripts/setup.sh            toolchain: rust 1.94.0, dotslash/protoc
  upstream.rev                ~ BuildTools versions/*.json pin

format-patch uses --zero-commit so rebases do not rewrite the From
line of every patch, and apply's git clean preserves work/target so
replaying patches does not cost a cold Rust rebuild.

Ships two [EXAMPLE PATCH] commits demonstrating a source edit and a
new-file addition; both are safe to delete.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+# One-time host setup: Rust toolchain + the protoc that proto codegen needs.
+# Idempotent -- safe to re-run.
+
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+setup_path
+
+info "Checking Rust toolchain"
+if ! command -v rustup >/dev/null 2>&1; then
+  step "rustup not found -- installing"
+  curl --proto '=https' --tlsv1.2 -fsSL https://sh.rustup.rs \
+    | sh -s -- -y --no-modify-path --profile default
+  setup_path
+else
+  step "rustup $(rustup --version 2>/dev/null | head -n1)"
+fi
+
+# rust-toolchain.toml pins the exact version (and extra targets). Running rustup
+# inside the tree makes it materialise that toolchain rather than the default.
+TOOLCHAIN_SRC=""
+for d in "$WORK_DIR" "$UPSTREAM_DIR"; do
+  [[ -f "$d/rust-toolchain.toml" ]] && { TOOLCHAIN_SRC="$d"; break; }
+done
+if [[ -n "$TOOLCHAIN_SRC" ]]; then
+  pinned="$(grep -E '^\s*channel' "$TOOLCHAIN_SRC/rust-toolchain.toml" | head -n1 | cut -d'"' -f2)"
+  step "Materialising pinned toolchain ${pinned:-from rust-toolchain.toml}"
+  (cd "$TOOLCHAIN_SRC" && rustup show >/dev/null)
+  step "$(cd "$TOOLCHAIN_SRC" && rustc --version)"
+else
+  warn "no checkout yet -- pinned toolchain will be installed on first 'make apply'"
+fi
+
+# protoc: xai-grok-tools-api's build script compiles proto/grok-tools.proto.
+# Upstream resolves it as $PROTOC -> ./bin/protoc (a DotSlash wrapper that
+# downloads protoc 29.3) -> protoc on PATH. Satisfy path 2, fall back to 3.
+info "Checking protoc"
+if command -v dotslash >/dev/null 2>&1; then
+  step "dotslash $(dotslash --version 2>/dev/null | head -n1)"
+else
+  step "dotslash not found -- installing (enables the hermetic bin/protoc)"
+  cargo install dotslash || warn "cargo install dotslash failed; will fall back to a system protoc"
+  setup_path
+fi
+
+probe_protoc() {
+  local d="$1"
+  [[ -x "$d/bin/protoc" ]] || return 1
+  (cd "$d" && ./bin/protoc --version) 2>/dev/null
+}
+
+resolved=""
+for d in "$WORK_DIR" "$UPSTREAM_DIR"; do
+  if out="$(probe_protoc "$d")"; then
+    step "hermetic bin/protoc works: $out"
+    resolved=1
+    break
+  fi
+done
+
+if [[ -z "$resolved" ]]; then
+  if command -v protoc >/dev/null 2>&1; then
+    step "falling back to system protoc: $(protoc --version)"
+  elif [[ -d "$WORK_DIR" || -d "$UPSTREAM_DIR" ]]; then
+    step "no working protoc -- installing protobuf-compiler"
+    sudo apt-get update -qq && sudo apt-get install -y -qq protobuf-compiler \
+      || die "could not provide a protoc. Install DotSlash (https://dotslash-cli.com) or protobuf-compiler manually."
+    step "system protoc: $(protoc --version)"
+  else
+    warn "no checkout yet -- protoc will be verified on first 'make apply'"
+  fi
+fi
+
+info "Setup complete."
+cat <<EOF
+
+  Add Rust to your interactive shell if you have not already:
+    fish:  source $CARGO_HOME/env.fish
+    bash:  source $CARGO_HOME/env
+
+  Next:
+    make apply     # build work/ from upstream + patches
+    make build     # compile the $BIN_NAME binary
+EOF