feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

skills/ack/templates/tasks.template.yaml

@@ -44,6 +44,12 @@ project:
           standard: ["auto"]
         test:
           standard: ["auto"]
+      grok:
+        developer:
+          standard: ["grok-4.5"]
+          strong: ["grok-4.6"]
+        test:
+          standard: ["grok-4.5"]
     profiles:
       codex-dev-standard:
         role: "developer"
@@ -80,6 +86,27 @@ project:
         model: "auto"
         reasoningEffort: null
         permissionMode: "workspace-write"
+      grok-dev-standard:
+        role: "developer"
+        cli: "grok"
+        tier: "standard"
+        model: "grok-4.5"
+        reasoningEffort: "medium"
+        permissionMode: "workspace-write"
+      grok-test-standard:
+        role: "test"
+        cli: "grok"
+        tier: "standard"
+        model: "grok-4.5"
+        reasoningEffort: "low"
+        permissionMode: "workspace-write"
+      grok-dev-strong:
+        role: "developer"
+        cli: "grok"
+        tier: "strong"
+        model: "grok-4.6"
+        reasoningEffort: "high"
+        permissionMode: "workspace-write"
     defaults:
       developer: "codex-dev-standard"
       test: "codex-test-standard"