Add Build Remote Agent phone pairing (gbr/1)

[LinespottingPrivate]

What

Docs-only adapter so agent-device users can pair Build Remote Agent as a phone spectator on the desktop coding-agent host.

agent-device still drives phones; GBR pairs a desktop coding agent to Build Remote Agent. Companion, not a replacement.

Phone is spectator + veto, not orchestrator. Attach only http://127.0.0.1:8788 or stdio gbr-mcp. No mailbox keys. Protocol gbr/1.

Files: docs/gbr.md, README.md

How

curl -fsSL https://grokbuildremote.com/install.sh | bash
gbr-agent version          # v0.6.0+
gbr-agent pair && gbr-agent run
curl -sS http://127.0.0.1:8788/health

Windows: irm https://grokbuildremote.com/install.ps1 | iex

Independent product by Linespotting AB. Not affiliated with xAI or SpaceX.
Agent: https://github.com/LinespottingOrg/GrokBuildRemote-Agents (MIT)

[thymikee]

Not ready at 83f40672:

1. This is an endorsement/install guide for an unrelated paid third-party product, not an agent-device adapter or capability. No command, daemon route, provider seam, or device workflow integrates with GBR; the change adds promotional top-level README placement and 56 lines of vendor-owned setup that can drift independently. Keep agent-device docs scoped to behavior we own and verify. If maintainers later establish a general third-party integrations index, this should be a short unaffiliated external link there—not a product-specific operational guide.
2. The proposed commands ask users and coding agents to execute a mutable remote install.sh/PowerShell script, or an unpinned clone plus npm install, on the coding-agent host. I inspected the current shell installer: although it currently defaults to v0.6.0 and uses an atomic-ish replace, it downloads the executable without verifying the published SHA-256. The linked Bot API can inject arbitrary text into terminal/coding-agent sessions; its loopback endpoint is unauthenticated by default unless GBR_BOT_REQUIRE_KEY=1 is set. “Attach only loopback/stdio” and “never commit keys” do not describe that trust boundary. Do not publish these install/attach instructions without an owned security review, pinned/checksum-verified artifacts, and accurate local/relay authority disclosure.

GitHub reports zero checks on this external-fork head. Given the scope mismatch, I recommend not merging this PR as written rather than expanding it into an agent-device integration.