feat: deliverable review gate, app lifecycle fixes, CI/CD pipeline

- Add deliverable review gate: pause workflow when agents produce important
  documents (PRDs, design docs, etc.) for human review before continuing
- Add company-level reviewDeliverables setting with onboarding card selector
- Block agent heartbeats when deliverable review is pending (agent + CEO)
- Trigger review at document creation time in API server for reliability
- Fix autoApproveHires vs reviewDeliverables conflict in approval-policy
- Fix app quit: force-exit on all platforms (macOS Dock, Windows tray, Linux)
- Add multi-platform CI/CD pipeline (macOS arm64/x64, Windows x64/arm64,
  Linux x64/arm64 with deb/AppImage/rpm/snap) with code signing support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/approval-policy.ts

@@ -11,10 +11,19 @@ export function shouldAutoApproveApproval(
     return false;
   }
 
-  return db
+  const company = db
     .listSnapshot()
     .companies
-    .some((company) => company.id === companyId && company.autoApproveHires);
+    .find((c) => c.id === companyId);
+
+  if (!company?.autoApproveHires) return false;
+
+  // When reviewDeliverables is ON, CEO strategy needs human review — don't auto-approve
+  if (approvalType === "approve_ceo_strategy" && company.reviewDeliverables) {
+    return false;
+  }
+
+  return true;
 }
 
 export function resolveApprovalDecision({