feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

tests/test_ack_delivery.py

@@ -303,6 +303,7 @@ class AckDeliveryValidationTests(unittest.TestCase):
             {
                 "enabled": False,
                 "defaultProfile": None,
+                "intents": {"testEnvironment": None, "release": None},
                 "entrypoints": {},
                 "artifacts": {},
                 "destinations": {},
@@ -313,6 +314,42 @@ class AckDeliveryValidationTests(unittest.TestCase):
 
         self.assertEqual(validate_delivery.validate_builtin(contract), [])
 
+    def test_intents_must_point_at_matching_stop_points(self) -> None:
+        contract = valid_contract()
+        contract["intents"] = {
+            "testEnvironment": "review",
+            "release": None,
+        }
+
+        errors = validate_delivery.validate_builtin(contract)
+        self.assertTrue(
+            any("intents.testEnvironment" in item and "validation_ready" in item for item in errors)
+        )
+
+        contract["intents"]["testEnvironment"] = "local-validation"
+        contract["profiles"]["local-validation"] = {
+            "stopAt": "validation_ready",
+            "steps": [
+                {"id": "build-local", "action": "build", "artifact": "service-deb"},
+                {
+                    "id": "deploy-local",
+                    "action": "deploy",
+                    "artifact": "service-deb",
+                    "environment": "test-server",
+                },
+                {
+                    "id": "health-local",
+                    "action": "health-check",
+                    "environment": "test-server",
+                },
+            ],
+        }
+        self.assertEqual(validate_delivery.validate_builtin(contract), [])
+
+        contract["intents"]["release"] = "missing-release"
+        errors = validate_delivery.validate_builtin(contract)
+        self.assertTrue(any("未定义 profile 'missing-release'" in item for item in errors))
+
 
 if __name__ == "__main__":
     unittest.main()