feat: deliverable review gate, app lifecycle fixes, CI/CD pipeline

- Add deliverable review gate: pause workflow when agents produce important
  documents (PRDs, design docs, etc.) for human review before continuing
- Add company-level reviewDeliverables setting with onboarding card selector
- Block agent heartbeats when deliverable review is pending (agent + CEO)
- Trigger review at document creation time in API server for reliability
- Fix autoApproveHires vs reviewDeliverables conflict in approval-policy
- Fix app quit: force-exit on all platforms (macOS Dock, Windows tray, Linux)
- Add multi-platform CI/CD pipeline (macOS arm64/x64, Windows x64/arm64,
  Linux x64/arm64 with deb/AppImage/rpm/snap) with code signing support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/main/orchestration-service.ts

@@ -335,6 +335,20 @@ export function createOrchestrationService({
       return null;
     }
 
+    // Block heartbeat when agent has tasks awaiting user deliverable review
+    // Check both: pending approval (gate created) and requires_user_review flag (gap before approval)
+    if (db.hasAgentPendingDeliverableReview(agentId, companyId) || db.hasAgentTaskAwaitingReview(agentId, companyId)) {
+      logger.info(`[heartbeat] Skipping ${agent.name} — awaiting user deliverable review.`);
+      return null;
+    }
+
+    // Block CEO heartbeat when company has any pending deliverable reviews
+    // CEO should not create new work while the user hasn't reviewed existing deliverables
+    if (!agent.reportsTo && db.hasPendingDeliverableReviews(companyId)) {
+      logger.info(`[heartbeat] Skipping CEO ${agent.name} — company has pending deliverable reviews.`);
+      return null;
+    }
+
     const assignedTasks = db.listAgentTasks(agentId, companyId, ["todo", "in_progress", "blocked"]);
     const isTimer = trigger === "timer";
     const candidateTasks = isTimer