refactor(model-pool): scope disabled-models by company; cascade on delete (v42)

The per-connector "enabled/disabled model" settings lived under a
global key in the settings key-value table
(`disabled_models:${connectorId}`). No company dimension. Deleting a
company left the pool choices behind, and creating a new company
silently inherited them — the visible symptom was "onboarding's team-
model configuration survives company deletion and pollutes the next
company's CEO model list."

Root fix, not a cleanup hook: the storage becomes a real relational
table with `(company_id, connector_id)` primary key and an
`ON DELETE CASCADE` FK from `companies`. Company deletion wipes pool
config by construction; no cleanup step in `deleteCompany()` can
drift.

Schema (migration v42):
- CREATE TABLE connector_model_pool_settings (company_id, connector_id,
  disabled_models_json, updated_at), PK (company_id, connector_id),
  FK companies(id) ON DELETE CASCADE.
- Drop every `settings.disabled_models:*` key — these were the bug's
  residue; there is no right company to attribute them to, so the
  migration clears them. Users re-select on next onboarding.

API surgery — every reader/writer now takes companyId:
- db.getDisabledModels(companyId, connectorId)
- db.setDisabledModels(companyId, connectorId, models)
- db.hasModelPoolSettings(companyId, connectorId)
- connector-model-policy: getConnectorModelPolicy(deps, companyId,
  connectorId); validateConnectorModelSelection(deps, companyId,
  connectorId, model)
- model-dispatch: listEnabledModels(companyId, deps);
  pickModelForAgent resolves companyId from agent.companyId
- orchestration heartbeat/task-runner/turn-context/run-dispatch pass
  the agent's or run's companyId through to the policy deps
- IPC schema: connectorDisabledModelsSchema gains companyId; new
  connectorModelPoolQuerySchema pairs companyId+connectorId for reads

Onboarding becomes commit-on-launch:
- useConnectorModelSelection no longer persists via IPC during
  onboarding. Toggles mutate local state; it exposes `poolSelections`
  to the wizard.
- bootstrapOnboardingSchema gains connectorPoolSelections. The
  onboarding service saves the company first, then persists each
  per-connector disabled list scoped to the new company id — CEO
  model validation runs against the company's freshly-persisted pool,
  not some stale global.
- IPC setConnectorDisabledModels now requires companyId; the only
  consumer was onboarding, which no longer calls it at all.
- Main-side listConnectorModels returns the raw provider catalog
  (no pool filtering), since that IPC is used from onboarding where
  no company exists yet; pool filtering happens at dispatch time.

saveConnector IPC drops the per-company pool validation — connector
config is a global hint, company-scoped enforcement belongs at run
dispatch where the company is known.

Tests: 603/603 green. Typecheck clean. Integration tests rewritten
to set the pool via connectorPoolSelections on bootstrap input, not
a pre-bootstrap global setDisabledModels call.

src/main/onboarding-service.ts

@@ -24,6 +24,10 @@ interface BootstrapInput {
   goalDescription: string;
   connectorId?: ConnectorId;
   connectorModel?: string;
+  connectorPoolSelections?: Array<{
+    connectorId: ConnectorId;
+    disabledModels: Array<{ id: string; label: string }>;
+  }>;
 }
 
 interface OnboardingDependencies {
@@ -215,10 +219,6 @@ export function createOnboardingService({
   function bootstrapOnboarding(input: BootstrapInput): OnboardingBootstrapSummary {
     const connectors = db.listSnapshot({ companyId: null }).connectors;
     const selectedConnectorId = resolveOnboardingConnector(connectors, input.connectorId);
-    const modelSelection = validateConnectorModelSelection(db, selectedConnectorId, input.connectorModel ?? null);
-    if (!modelSelection.ok) {
-      throw new Error(modelSelection.error);
-    }
 
     const companyId = db.saveCompany({
       name: input.companyName.trim(),
@@ -228,6 +228,23 @@ export function createOnboardingService({
       reviewDeliverables: input.reviewDeliverables,
       executionMode: input.executionMode ?? "ai_ceo",
     });
+
+    // Persist the user's per-connector disabled-model selections
+    // against the freshly-created company id. Onboarding is entirely
+    // pre-commit; the pool settings arrive in the input payload and
+    // land in the DB only once a company exists to scope them.
+    for (const pool of input.connectorPoolSelections ?? []) {
+      db.setDisabledModels(companyId, pool.connectorId, pool.disabledModels);
+    }
+
+    // Validate the CEO model selection against the now-persisted pool
+    // scoped to this new company. Must run AFTER the pool is stored,
+    // otherwise the validator sees an empty pool and accepts anything.
+    const modelSelection = validateConnectorModelSelection(db, companyId, selectedConnectorId, input.connectorModel ?? null);
+    if (!modelSelection.ok) {
+      throw new Error(modelSelection.error);
+    }
+
     const workspaceId = createDefaultWorkspace(companyId, input.workspacePath);
 
     const goalTitle = input.goalTitle.trim();