feat: deliverable review gate, app lifecycle fixes, CI/CD pipeline

- Add deliverable review gate: pause workflow when agents produce important
  documents (PRDs, design docs, etc.) for human review before continuing
- Add company-level reviewDeliverables setting with onboarding card selector
- Block agent heartbeats when deliverable review is pending (agent + CEO)
- Trigger review at document creation time in API server for reliability
- Fix autoApproveHires vs reviewDeliverables conflict in approval-policy
- Fix app quit: force-exit on all platforms (macOS Dock, Windows tray, Linux)
- Add multi-platform CI/CD pipeline (macOS arm64/x64, Windows x64/arm64,
  Linux x64/arm64 with deb/AppImage/rpm/snap) with code signing support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/ipc-core-work-graph-handlers.ts

@@ -346,6 +346,10 @@ export function registerCoreWorkGraphHandlers({
       if (previousStatus && previousStatus !== parsed.status) {
         handleTaskStatusChange(id, parsed.companyId, previousStatus, parsed.status);
       }
+      // User (board) manually advancing a flagged task to done: clear the review flag
+      if (parsed.status === "done") {
+        try { db.setTaskRequiresUserReview(id, false); } catch { /* best effort */ }
+      }
       // Wake new assignee when task is reassigned (matches api-server.ts behavior)
       if (parsed.assigneeAgentId && parsed.assigneeAgentId !== previousAssigneeAgentId) {
         wakeAgentIfPossible(parsed.assigneeAgentId, parsed.companyId, "assignment");