fix(worker): invert connector bypass default and gate on packaged build (S-01)

Previously `AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS !== "false"` meant
packaged builds defaulted to passing `dangerouslyBypassApprovalsAndSandbox`,
`dangerouslySkipPermissions`, `yolo`, and `--sandbox danger-full-access`
to CLI connectors, bypassing ApprovalService entirely.

Require both explicit opt-in (`AGENTCOMPANY_ALLOW_UNSAFE_CONNECTOR_BYPASS=true`)
and a non-packaged build. Packaged builds hard-refuse regardless of the env
var. Main process forks the worker with `AGENTCOMPANY_PACKAGED=<app.isPackaged>`
so the worker has an authoritative packaged signal.

src/main/worker-service.ts

@@ -1,4 +1,4 @@
-import { utilityProcess } from "electron";
+import { app, utilityProcess } from "electron";
 import { workerMessageSchema, type WorkerServiceDependencies } from "./worker/worker-types";
 import { handleWorkerExit } from "./worker/worker-crash-recovery";
 import { handleWorkerMessage } from "./worker/worker-message-handler";
@@ -37,9 +37,15 @@ export function createWorkerService({
   }
 
   function createWorker() {
+    // S-01: Propagate packaged-build signal so the worker can hard-refuse
+    // connector bypass flags in production.
     worker = utilityProcess.fork(workerPath, [], {
       stdio: "pipe",
       serviceName: "AgentCompany Orchestrator",
+      env: {
+        ...process.env,
+        AGENTCOMPANY_PACKAGED: app.isPackaged ? "true" : "false",
+      },
     });
 
     worker.stdout?.on("data", (chunk) => {