refactor(model-pool): scope disabled-models by company; cascade on delete (v42)

The per-connector "enabled/disabled model" settings lived under a
global key in the settings key-value table
(`disabled_models:${connectorId}`). No company dimension. Deleting a
company left the pool choices behind, and creating a new company
silently inherited them — the visible symptom was "onboarding's team-
model configuration survives company deletion and pollutes the next
company's CEO model list."

Root fix, not a cleanup hook: the storage becomes a real relational
table with `(company_id, connector_id)` primary key and an
`ON DELETE CASCADE` FK from `companies`. Company deletion wipes pool
config by construction; no cleanup step in `deleteCompany()` can
drift.

Schema (migration v42):
- CREATE TABLE connector_model_pool_settings (company_id, connector_id,
  disabled_models_json, updated_at), PK (company_id, connector_id),
  FK companies(id) ON DELETE CASCADE.
- Drop every `settings.disabled_models:*` key — these were the bug's
  residue; there is no right company to attribute them to, so the
  migration clears them. Users re-select on next onboarding.

API surgery — every reader/writer now takes companyId:
- db.getDisabledModels(companyId, connectorId)
- db.setDisabledModels(companyId, connectorId, models)
- db.hasModelPoolSettings(companyId, connectorId)
- connector-model-policy: getConnectorModelPolicy(deps, companyId,
  connectorId); validateConnectorModelSelection(deps, companyId,
  connectorId, model)
- model-dispatch: listEnabledModels(companyId, deps);
  pickModelForAgent resolves companyId from agent.companyId
- orchestration heartbeat/task-runner/turn-context/run-dispatch pass
  the agent's or run's companyId through to the policy deps
- IPC schema: connectorDisabledModelsSchema gains companyId; new
  connectorModelPoolQuerySchema pairs companyId+connectorId for reads

Onboarding becomes commit-on-launch:
- useConnectorModelSelection no longer persists via IPC during
  onboarding. Toggles mutate local state; it exposes `poolSelections`
  to the wizard.
- bootstrapOnboardingSchema gains connectorPoolSelections. The
  onboarding service saves the company first, then persists each
  per-connector disabled list scoped to the new company id — CEO
  model validation runs against the company's freshly-persisted pool,
  not some stale global.
- IPC setConnectorDisabledModels now requires companyId; the only
  consumer was onboarding, which no longer calls it at all.
- Main-side listConnectorModels returns the raw provider catalog
  (no pool filtering), since that IPC is used from onboarding where
  no company exists yet; pool filtering happens at dispatch time.

saveConnector IPC drops the per-company pool validation — connector
config is a global hint, company-scoped enforcement belongs at run
dispatch where the company is known.

Tests: 603/603 green. Typecheck clean. Integration tests rewritten
to set the pool via connectorPoolSelections on bootstrap input, not
a pre-bootstrap global setDisabledModels call.

src/main/orchestration/heartbeat.ts

@@ -44,7 +44,7 @@ export function createHeartbeat(
     }
     const assignment = pickModelForAgent(agent, {
       getConnector: (id) => db.getConnector(id),
-      getDisabledModels: (id) => db.getDisabledModels(id),
+      getDisabledModels: (id) => db.getDisabledModels(agent.companyId, id),
       getCeoAssignment: (cid) => {
         const ceo = db.getCeoForCompany(cid);
         if (!ceo) return null;

src/main/orchestration/run-dispatch.ts

@@ -47,7 +47,7 @@ export function createRunDispatch(deps: OrchestrationDependencies) {
       logger.info(`[run] Agent ${agent.name} connector ${connector.id} blocked: ${issue}`);
       return "CONNECTOR_NOT_READY";
     }
-    const modelSelection = validateConnectorModelSelection(db, connector.id, agent.model ?? null);
+    const modelSelection = validateConnectorModelSelection(db, agent.companyId, connector.id, agent.model ?? null);
     if (!modelSelection.ok) {
       logger.info(`[run] Agent ${agent.name} connector model blocked: ${modelSelection.error}`);
       return "CONNECTOR_MODEL_NOT_ALLOWED";

src/main/orchestration/task-runner.ts

@@ -49,7 +49,7 @@ export function createTaskRunner(
     }
     const assignment = pickModelForAgent(agent, {
       getConnector: (id) => db.getConnector(id),
-      getDisabledModels: (id) => db.getDisabledModels(id),
+      getDisabledModels: (id) => db.getDisabledModels(agent.companyId, id),
       getCeoAssignment: (cid) => {
         const ceo = db.getCeoForCompany(cid);
         if (!ceo) return null;

src/main/orchestration/turn-context.ts

@@ -132,9 +132,10 @@ function resolveSkills(
 
 function resolveEnabledConnectorModels(
   db: AppDatabase,
+  companyId: string,
   connector: { id: string; model: string | null },
 ): string[] {
-  return getConnectorModelPolicy(db, connector.id as ConnectorId).enabledModels.map((model) => model.id);
+  return getConnectorModelPolicy(db, companyId, connector.id as ConnectorId).enabledModels.map((model) => model.id);
 }
 
 function resolveSession(
@@ -261,16 +262,17 @@ function filterPendingApprovals(
 
 function buildConnectorCatalog(
   db: AppDatabase,
+  companyId: string,
   connectors: RunDispatchParams["snapshot"]["connectors"],
 ) {
   return connectors
     .filter((c) => c.status === "ready")
-    .filter((c) => db.hasModelPoolSettings(c.id))
+    .filter((c) => db.hasModelPoolSettings(companyId, c.id))
     .map((c) => ({
       id: c.id,
       label: c.label,
       status: c.status,
-      enabledModels: resolveEnabledConnectorModels(db, c),
+      enabledModels: resolveEnabledConnectorModels(db, companyId, c),
     }))
     .filter((c) => c.enabledModels.length > 0);
 }
@@ -325,7 +327,7 @@ export function buildRunPayload(params: RunDispatchParams, deps: TurnContextDeps
     relevantKnowledge: filterRelevantKnowledge(snapshot.knowledgeBase, companyId),
     activeSprint: snapshot.sprints.find((sprint) => sprint.companyId === companyId && sprint.status === "active") ?? null,
     recentDocuments: filterRecentDocuments(snapshot.documents, companyId, agent.id),
-    allConnectors: buildConnectorCatalog(db, snapshot.connectors),
+    allConnectors: buildConnectorCatalog(db, companyId, snapshot.connectors),
     sessionHandoff,
     skills,
     companySkillCatalog: db.listCompanySkills(companyId).map((skill) => ({
@@ -341,7 +343,7 @@ export function buildRunPayload(params: RunDispatchParams, deps: TurnContextDeps
 
   const thinkingEffort = extractThinkingEffort(agent.metadataJson, deps.logger, agent.id);
   const modelForRun = params.resolvedModel !== undefined ? params.resolvedModel : agent.model;
-  const modelSelection = validateConnectorModelSelection(db, connector.id, modelForRun);
+  const modelSelection = validateConnectorModelSelection(db, companyId, connector.id, modelForRun);
   if (!modelSelection.ok) {
     throw new Error(modelSelection.error);
   }