feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/templates/tasks.schema.json

@@ -338,7 +338,8 @@
       "additionalProperties": false,
       "properties": {
         "codex": { "$ref": "#/definitions/modelRoleAllowlist" },
-        "cursor-agent": { "$ref": "#/definitions/modelRoleAllowlist" }
+        "cursor-agent": { "$ref": "#/definitions/modelRoleAllowlist" },
+        "grok": { "$ref": "#/definitions/modelRoleAllowlist" }
       }
     },
     "workerProfile": {
@@ -359,7 +360,7 @@
         },
         "cli": {
           "type": "string",
-          "enum": ["codex", "cursor-agent"]
+          "enum": ["codex", "cursor-agent", "grok"]
         },
         "tier": {
           "type": "string",
@@ -517,7 +518,7 @@
       "properties": {
         "cli": {
           "type": "string",
-          "enum": ["codex", "cursor-agent"]
+          "enum": ["codex", "cursor-agent", "grok"]
         },
         "tier": {
           "type": "string",
@@ -989,9 +990,14 @@
           "type": "string",
           "pattern": "^[a-z][a-z0-9-]{0,63}$"
         },
+        "intent": {
+          "type": "string",
+          "enum": ["testEnvironment", "release"],
+          "description": "用户触发的测试环境或发版操作；有 intent 时 taskIds 可为 []"
+        },
         "taskIds": {
           "type": "array",
-          "minItems": 1,
+          "minItems": 0,
           "uniqueItems": true,
           "items": { "type": "string", "minLength": 1 }
         },