Route goal kickoffs through task policy and revive waiting goals on hire

Adversarial review of the kickoff feature surfaced two gaps. First, the
kickoff task was inserted with raw SQL, so a workspace-bound kickoff
carried requires_filesystem without the execution approval every other
task receives - manual runs failed and review-mode orgs had no approval
trail. Kickoffs (in-app and onboarding) now go through createTask and
its policy gates. Second, a goal created before any agent existed
stayed inert forever; creating an agent now operationalizes every
active goal that has no task yet. Goal owners must be active agents:
an archived owner falls back to the top-level agent and the owner
dropdown only offers active agents.

AgentCompany-New/src/renderer/src/pages/work/GoalDialog.tsx

@@ -43,7 +43,9 @@ export function GoalDialog({
       <Field label="Owner agent">
         <select className="input" name="ownerAgentId" defaultValue="">
           <option value="">Unassigned</option>
-          {agents.map((agent) => <option key={agent.id} value={agent.id}>{agent.name} · {agent.role}</option>)}
+          {agents.filter((agent) => agent.lifecycle === "active").map((agent) => (
+            <option key={agent.id} value={agent.id}>{agent.name} · {agent.role}</option>
+          ))}
         </select>
       </Field>
     </Dialog>