feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/scripts/validate_tasks.py

@@ -103,6 +103,8 @@ DELIVERY_RUN_FIELDS = {
     "evidence",
     "updatedAt",
 }
+DELIVERY_RUN_OPTIONAL_FIELDS = {"intent"}
+DELIVERY_RUN_INTENTS = {"testEnvironment", "release"}
 DELIVERY_STATUSES = {
     "planned",
     "running",
@@ -481,7 +483,9 @@ def validate_delivery_runs(
         if not isinstance(run, dict):
             errors.append(f"{where}: 必须是对象")
             continue
-        reject_unknown_fields(run, DELIVERY_RUN_FIELDS, where, errors)
+        reject_unknown_fields(
+            run, DELIVERY_RUN_FIELDS | DELIVERY_RUN_OPTIONAL_FIELDS, where, errors
+        )
         missing = sorted(DELIVERY_RUN_FIELDS - set(run))
         for field in missing:
             errors.append(f"{where}.{field}: 必填")
@@ -501,13 +505,23 @@ def validate_delivery_runs(
         if status not in DELIVERY_STATUSES:
             errors.append(f"{where}.status: 必须是 {sorted(DELIVERY_STATUSES)}")
 
+        intent = run.get("intent")
+        if "intent" in run and intent not in DELIVERY_RUN_INTENTS:
+            errors.append(
+                f"{where}.intent: 必须是 {sorted(DELIVERY_RUN_INTENTS)}"
+            )
         task_ids = run.get("taskIds")
+        allow_empty_tasks = intent in DELIVERY_RUN_INTENTS
         if (
             not isinstance(task_ids, list)
-            or not task_ids
-            or any(not _nonempty_string(task_id) for task_id in task_ids)
+            or (not task_ids and not allow_empty_tasks)
+            or any(not _nonempty_string(task_id) for task_id in (task_ids or []))
         ):
-            errors.append(f"{where}.taskIds: 必须是非空任务 ID 列表")
+            errors.append(
+                f"{where}.taskIds: 必须是任务 ID 列表"
+                if allow_empty_tasks
+                else f"{where}.taskIds: 必须是非空任务 ID 列表"
+            )
             task_ids = []
         elif len(task_ids) != len(set(task_ids)):
             errors.append(f"{where}.taskIds: 不能包含重复值")