feat(ack): add grok workers and allow --always-approve

Grok is a first-class worker CLI. Launcher argv includes --always-approve so
unattended tool calls are not blocked; sandbox stays required.

tests/test_ack_tasks_validation.py

@@ -438,6 +438,47 @@ class AckTaskValidationTests(unittest.TestCase):
 
         self.assert_board_accepted_in_all_modes(board)
 
+    def test_intent_delivery_run_allows_empty_task_ids(self) -> None:
+        board = valid_manual_routing_board()
+        board["project"]["deliveryFile"] = "docs/ack/delivery.yaml"
+        board["deliveryRuns"] = [
+            {
+                "id": "DR-test-env-1",
+                "profile": "test-local",
+                "intent": "testEnvironment",
+                "taskIds": [],
+                "status": "validation_ready",
+                "sourceRevision": "a" * 40,
+                "configRevision": "b" * 40,
+                "pullRequest": None,
+                "artifacts": [
+                    {
+                        "id": "garden-bin",
+                        "type": "file",
+                        "reference": "garden",
+                        "digest": "sha256:" + "c" * 64,
+                    }
+                ],
+                "deployments": [
+                    {
+                        "environment": "local-write",
+                        "result": "succeeded",
+                        "evidence": "GET /login returned 200",
+                    }
+                ],
+                "evidence": ["http://write.localhost:8080/ ready"],
+                "updatedAt": "2026-08-23T00:57:00+08:00",
+            }
+        ]
+
+        self.assert_board_accepted_in_all_modes(board)
+
+        del board["deliveryRuns"][0]["intent"]
+        self.assert_board_rejected_in_all_modes(
+            board,
+            "taskIds: 必须是非空任务 ID 列表",
+        )
+
     def test_delivery_runs_and_delivery_file_must_appear_together(self) -> None:
         board = valid_manual_routing_board()
         board["deliveryRuns"] = []