feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/templates/delivery.schema.json

@@ -32,6 +32,7 @@
       "type": ["string", "null"],
       "pattern": "^[a-z][a-z0-9-]{0,63}$"
     },
+    "intents": { "$ref": "#/definitions/intents" },
     "entrypoints": {
       "type": "object",
       "propertyNames": { "$ref": "#/definitions/id" },
@@ -63,6 +64,21 @@
       "type": "string",
       "pattern": "^[a-z][a-z0-9-]{0,63}$"
     },
+    "intents": {
+      "type": "object",
+      "required": ["testEnvironment", "release"],
+      "additionalProperties": false,
+      "properties": {
+        "testEnvironment": {
+          "type": ["string", "null"],
+          "pattern": "^[a-z][a-z0-9-]{0,63}$"
+        },
+        "release": {
+          "type": ["string", "null"],
+          "pattern": "^[a-z][a-z0-9-]{0,63}$"
+        }
+      }
+    },
     "relativePath": {
       "type": "string",
       "minLength": 1,