Require Grok orchestrator with local wwg3-worker for product work.

Keep paid parent session coordinator-only; pin and document that all
implement/review/check subagents use the LAN wwg3-worker endpoint.

.grok/rules/local-worker.md

@@ -0,0 +1,29 @@
+# Local worker + Grok orchestrator (mandatory)
+
+Full SSOT: `AGENTS.md` → **Orchestrator vs local worker (mandatory)**.
+
+## Split
+
+| Role | Model | Job |
+|------|-------|-----|
+| Parent session (composer) | Grok (`grok-4.5` / session default) | Orchestrate only |
+| Every subagent / workflow child | **`wwg3-worker`** (local endpoint) | **All product work** |
+
+## Orchestrator MUST
+
+- Spawn workers with `model: "wwg3-worker"` for explore / plan / implement / review / check / fix.
+- Inject product rails + authorized slice into every worker prompt.
+- Sequence the execution loop; talk to the user; enforce no push unless asked.
+- If local endpoint fails: **stop and report** — do not finish the work on paid Grok.
+
+## Orchestrator MUST NOT
+
+- Implement product code (`write` / `search_replace` / bulk codegen) in the parent when a worker should.
+- Omit `model` / use cloud models for workers without an explicit user override for that task.
+- Use the local worker as the parent orchestrator model.
+
+## Exceptions (parent only)
+
+Agent-rules edits (`AGENTS.md`, `.grok/rules/*`), pure Q&A, orientation reads, git inspect, local commit **when user asks**, kill/stop subagents, true one-line nits requested in-chat.
+
+When unsure → **delegate to `wwg3-worker`**.