fix(worker): invert connector bypass default and gate on packaged build (S-01)

Previously `AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS !== "false"` meant
packaged builds defaulted to passing `dangerouslyBypassApprovalsAndSandbox`,
`dangerouslySkipPermissions`, `yolo`, and `--sandbox danger-full-access`
to CLI connectors, bypassing ApprovalService entirely.

Require both explicit opt-in (`AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS=true`)
and a non-packaged build. Packaged builds hard-refuse regardless of the env
var. Main process forks the worker with `AGENTCOMPANY_PACKAGED=<app.isPackaged>`
so the worker has an authoritative packaged signal.

src/main/worker/worker-entry.ts

@@ -80,10 +80,13 @@ const activeByAgent = new Map<string, string>();
 const activeByWorkspace = new Map<string, string>();
 const queue: RunJob[] = [];
 const cancelledRuns = new Set<string>();
-// Agent runs are autonomous by design — they must execute commands without interactive approval.
-// The env-var gate is retained as an emergency kill switch but defaults to enabled.
+// S-01: Bypass is opt-in only. Packaged builds hard-refuse the dangerous CLI
+// flags unless the operator sets BOTH `AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS=true`
+// AND is running a dev/E2E build (AGENTCOMPANY_PACKAGED !== "true"). Main forks
+// the worker with AGENTCOMPANY_PACKAGED=<app.isPackaged>.
+const isPackaged = process.env.AGENTCOMPANY_PACKAGED === "true";
 const allowUnsafeConnectorBypass =
-  process.env.AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS !== "false";
+  !isPackaged && process.env.AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS === "true";
 
 function post(message: ChildMessage) {
   parentPort.postMessage(message);