feat(ai): /grant ai grants drive to every AI agent at once

So the owner never has to name each model. Tracks an ai_agents set
(populated from `_ai` typing/stream frames and the "(ai) online" announce,
pruned on leave); `/grant ai` intersects it with the live roster and grants
all in one ACL broadcast. Help text gains a /grant ai row.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

hh/src/ui.rs

@@ -364,6 +364,7 @@ fn help_clusters(theme: &Theme) -> Vec<HelpCluster> {
                     "/grant <user|agent>",
                     "let a member OR an AI agent drive the shell",
                 ),
+                kv("/grant ai", "grant drive to every AI agent at once"),
                 kv("/revoke <user|agent>", "take back sandbox drive permission"),
                 kv("/sudo <user>", "delegate VM superuser (real sudo)"),
                 kv("/unsudo <user>", "revoke VM superuser"),