feat(acp): move five pinned agent CLIs to their current releases

OpenClaw 2026.7.1 to 2026.8.1, Hermes 0.20.6 to 0.21.0, CodeBuddy 2.141.0 to
2.143.0, Grok 1.0.5 to 1.0.13, Qoder 1.1.33 to 1.1.40. Every launch contract the
registry encodes still holds under the new pins: `acp` remains a subcommand on
OpenClaw and Hermes, `--acp` a registered option on CodeBuddy and Qoder, `agent
stdio` the ACP entry on Grok, and each package's declared `engines.node` still
matches its `node_required` floor.

OpenClaw keeps its MCP opt-out because the bridge still demands it: every ACP
session entry point rejects a non-empty `mcpServers` outright, so neither user
servers nor the codeg-mcp companion may ride its wire.

Hermes rides a community npm bridge, so its pin is exact and re-audited every
bump: the whole tarball except `package.json` is byte-identical to 0.20.6,
`postinstall.js` matches by digest, and the new upstream tag v2026.8.31
dereferences to the pinned commit 29112bef.

Grok's root flags still have to precede `agent stdio`, which accepts only
--debug/--debug-file/--leader-socket; `--no-auto-update` stays accepted while
unlisted, `initialize` still advertises sessionCapabilities list/resume/close so
the resume rung holds, and `--permission-mode` still takes exactly the six values
GrokSettings::permission_mode can carry. Qoder's config-dir resolver keeps its
precedence, keys and `.qoder` default beneath renamed minified identifiers; the
comments mirroring both now name the version they were last checked against.