feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/scripts/validate_delivery.py

@@ -43,6 +43,7 @@ TOP_LEVEL_FIELDS = {
     "project",
     "enabled",
     "defaultProfile",
+    "intents",
     "entrypoints",
     "artifacts",
     "destinations",
@@ -99,6 +100,11 @@ CHANNELS = {"preview", "staging", "stable"}
 ENVIRONMENT_TYPES = {"ssh-host", "docker-compose", "kubernetes", "custom"}
 CLASSIFICATIONS = {"development", "staging", "production"}
 STOP_POINTS = {"verified", "validation_ready", "review_ready", "released"}
+INTENT_FIELDS = {"testEnvironment", "release"}
+INTENT_STOP_AT = {
+    "testEnvironment": "validation_ready",
+    "release": "released",
+}
 ACTIONS = {
     "verify",
     "pull-request",
@@ -675,6 +681,38 @@ def _validate_profiles(
                 errors.append(f"{where}: defaultProfile 不能部署 production 环境")
 
 
+def _validate_intents(
+    values: Any,
+    profiles: dict[str, Any],
+    errors: list[str],
+) -> None:
+    if values is None:
+        return
+    if not _mapping(values):
+        errors.append("intents: 必须是对象")
+        return
+    _reject_unknown(values, INTENT_FIELDS, "intents", errors)
+    for field in sorted(INTENT_FIELDS):
+        if field not in values:
+            errors.append(f"intents.{field}: 必填")
+            continue
+        profile_id = values[field]
+        if profile_id is None:
+            continue
+        if not isinstance(profile_id, str) or ID_RE.fullmatch(profile_id) is None:
+            errors.append(f"intents.{field}: 必须是 null 或小写连字符 profile ID")
+            continue
+        profile = profiles.get(profile_id)
+        if profile is None:
+            errors.append(f"intents.{field}: 未定义 profile {profile_id!r}")
+            continue
+        expected_stop = INTENT_STOP_AT[field]
+        if _mapping(profile) and profile.get("stopAt") != expected_stop:
+            errors.append(
+                f"intents.{field}: profile {profile_id!r} 必须 stopAt {expected_stop}"
+            )
+
+
 def validate_builtin(data: dict[str, Any], project_root: Path | None = None) -> list[str]:
     errors: list[str] = []
     _reject_unknown(data, TOP_LEVEL_FIELDS, "<root>", errors)
@@ -720,6 +758,7 @@ def validate_builtin(data: dict[str, Any], project_root: Path | None = None) ->
         environments=environments,
         errors=errors,
     )
+    _validate_intents(data.get("intents"), profiles, errors)
 
     if enabled:
         if default_profile not in profiles: