feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/examples/delivery.example.yaml

@@ -6,6 +6,10 @@ project:
 enabled: true
 defaultProfile: "review"
 
+intents:
+  testEnvironment: test-env
+  release: null
+
 entrypoints:
   verify:
     kind: make
@@ -100,6 +104,19 @@ environments:
     mutex: "notes-test-deploy"
 
 profiles:
+  test-env:
+    stopAt: validation_ready
+    steps:
+      - id: build-deb
+        action: build
+        artifact: service-deb
+      - id: deploy-test
+        action: deploy
+        artifact: service-deb
+        environment: test-server
+      - id: smoke-test
+        action: health-check
+        environment: test-server
   review:
     stopAt: review_ready
     steps: