Promote AgentCompany-New to the repository root and retire the old app

The legacy application - its src, tests, landing site, promo assets, docs,
release tooling, CI workflows, and root configs - leaves the tree; it stays
reachable in history. Everything under AgentCompany-New moves up unchanged:
same package name, so the production userData/database path is untouched,
and e2e/build scripts already resolved paths relative to the project. The
developer cred.txt stays gitignored at its new location. Full verify:ci
passes from the new root.

src/shared/identity-domain.ts

@@ -0,0 +1,34 @@
+type ValueOf<T> = T[keyof T];
+
+export const IDENTITY_SOURCE = { BOOTSTRAP: "bootstrap", SSO: "sso", SCIM: "scim" } as const;
+export const ROLE_KEY = {
+  ORG_ADMIN: "org_admin",
+  APPROVAL_DECIDER: "approval_decider",
+  HIRING_MANAGER: "hiring_manager",
+  SCOPED_AGENT: "scoped_agent",
+} as const;
+export const ACCESS_DECISION = { ALLOW: "allow", DENY: "deny" } as const;
+
+export type IdentitySource = ValueOf<typeof IDENTITY_SOURCE>;
+export type RoleKey = ValueOf<typeof ROLE_KEY>;
+export type AccessDecision = ValueOf<typeof ACCESS_DECISION>;
+export type PrincipalType = "employee" | "agent" | "service_identity";
+
+export interface EmployeeIdentityRecord {
+  id: string; orgId: string; employeeId: string; source: IdentitySource; externalSubject: string;
+  email: string | null; active: boolean; createdAt: string; lastSeenAt: string | null;
+}
+
+export interface ServiceIdentityRecord {
+  id: string; orgId: string; agentId: string; name: string; scopeJson: string; createdAt: string;
+}
+
+export interface RoleGrantRecord {
+  id: string; orgId: string; principalType: PrincipalType; principalId: string; roleKey: RoleKey;
+  scopeType: string; scopeId: string; grantedByEmployeeId: string | null; createdAt: string;
+}
+
+export interface AccessDecisionRecord {
+  id: string; orgId: string; principalType: PrincipalType; principalId: string; action: string;
+  resourceType: string; resourceId: string; decision: AccessDecision; reason: string; createdAt: string;
+}