feat: deliverable review gate, app lifecycle fixes, CI/CD pipeline

- Add deliverable review gate: pause workflow when agents produce important
  documents (PRDs, design docs, etc.) for human review before continuing
- Add company-level reviewDeliverables setting with onboarding card selector
- Block agent heartbeats when deliverable review is pending (agent + CEO)
- Trigger review at document creation time in API server for reliability
- Fix autoApproveHires vs reviewDeliverables conflict in approval-policy
- Fix app quit: force-exit on all platforms (macOS Dock, Windows tray, Linux)
- Add multi-platform CI/CD pipeline (macOS arm64/x64, Windows x64/arm64,
  Linux x64/arm64 with deb/AppImage/rpm/snap) with code signing support

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/shared/contracts.ts

@@ -86,6 +86,7 @@ export const companyInputSchema = z.object({
   description: z.string().max(500).default(""),
   status: z.enum(["active", "paused", "archived"]).default("active"),
   autoApproveHires: z.boolean().default(false),
+  reviewDeliverables: z.boolean().default(false),
 });
 
 export const connectorInputSchema = z.object({
@@ -180,7 +181,7 @@ export const approvalInputSchema = z.object({
   relatedTaskId: optionalId,
   requestedByAgentId: optionalId,
   relatedAgentId: optionalId,
-  type: z.enum(["hire_agent", "approve_ceo_strategy", "dangerous_command", "secret_access", "budget_request", "promotion", "termination", "vendor_approval", "document_review", "production_deploy", "incident_escalation", "social_post"]),
+  type: z.enum(["hire_agent", "approve_ceo_strategy", "dangerous_command", "secret_access", "budget_request", "promotion", "termination", "vendor_approval", "document_review", "production_deploy", "incident_escalation", "social_post", "deliverable_review"]),
   payloadSummary: z.string().min(2).max(280),
   impactSummary: z.string().min(2).max(400),
   payloadJson: z.string().nullable().optional(),
@@ -287,6 +288,7 @@ export const bootstrapOnboardingSchema = z.object({
   companyDescription: z.string().max(500).default(""),
   workspacePath: z.string().default(""),
   autoApproveHires: z.boolean().default(true),
+  reviewDeliverables: z.boolean().default(false),
   goalTitle: z.string().default(""),
   goalDescription: z.string().default(""),
   connectorId: z.enum(["codex_local", "claude_local", "gemini_local"]).optional(),

src/shared/types.ts

@@ -65,7 +65,8 @@ export type ApprovalType =
   | "document_review"
   | "production_deploy"
   | "incident_escalation"
-  | "social_post";
+  | "social_post"
+  | "deliverable_review";
 export type RunStatus =
   | "queued"
   | "running"
@@ -89,6 +90,7 @@ export interface CompanyRecord {
   description: string;
   status: CompanyStatus;
   autoApproveHires: boolean;
+  reviewDeliverables: boolean;
   createdAt: string;
   updatedAt: string;
 }
@@ -202,6 +204,7 @@ export interface TaskRecord {
   sessionJson: string | null;
   sessionDisplayId: string | null;
   costUsd: number;
+  requiresUserReview: boolean;
   createdAt: string;
   updatedAt: string;
 }