refactor(model-pool): scope disabled-models by company; cascade on delete (v42)

The per-connector "enabled/disabled model" settings lived under a
global key in the settings key-value table
(`disabled_models:${connectorId}`). No company dimension. Deleting a
company left the pool choices behind, and creating a new company
silently inherited them — the visible symptom was "onboarding's team-
model configuration survives company deletion and pollutes the next
company's CEO model list."

Root fix, not a cleanup hook: the storage becomes a real relational
table with `(company_id, connector_id)` primary key and an
`ON DELETE CASCADE` FK from `companies`. Company deletion wipes pool
config by construction; no cleanup step in `deleteCompany()` can
drift.

Schema (migration v42):
- CREATE TABLE connector_model_pool_settings (company_id, connector_id,
  disabled_models_json, updated_at), PK (company_id, connector_id),
  FK companies(id) ON DELETE CASCADE.
- Drop every `settings.disabled_models:*` key — these were the bug's
  residue; there is no right company to attribute them to, so the
  migration clears them. Users re-select on next onboarding.

API surgery — every reader/writer now takes companyId:
- db.getDisabledModels(companyId, connectorId)
- db.setDisabledModels(companyId, connectorId, models)
- db.hasModelPoolSettings(companyId, connectorId)
- connector-model-policy: getConnectorModelPolicy(deps, companyId,
  connectorId); validateConnectorModelSelection(deps, companyId,
  connectorId, model)
- model-dispatch: listEnabledModels(companyId, deps);
  pickModelForAgent resolves companyId from agent.companyId
- orchestration heartbeat/task-runner/turn-context/run-dispatch pass
  the agent's or run's companyId through to the policy deps
- IPC schema: connectorDisabledModelsSchema gains companyId; new
  connectorModelPoolQuerySchema pairs companyId+connectorId for reads

Onboarding becomes commit-on-launch:
- useConnectorModelSelection no longer persists via IPC during
  onboarding. Toggles mutate local state; it exposes `poolSelections`
  to the wizard.
- bootstrapOnboardingSchema gains connectorPoolSelections. The
  onboarding service saves the company first, then persists each
  per-connector disabled list scoped to the new company id — CEO
  model validation runs against the company's freshly-persisted pool,
  not some stale global.
- IPC setConnectorDisabledModels now requires companyId; the only
  consumer was onboarding, which no longer calls it at all.
- Main-side listConnectorModels returns the raw provider catalog
  (no pool filtering), since that IPC is used from onboarding where
  no company exists yet; pool filtering happens at dispatch time.

saveConnector IPC drops the per-company pool validation — connector
config is a global hint, company-scoped enforcement belongs at run
dispatch where the company is known.

Tests: 603/603 green. Typecheck clean. Integration tests rewritten
to set the pool via connectorPoolSelections on bootstrap input, not
a pre-bootstrap global setDisabledModels call.

tests/integration/connector-model-enforcement.spec.ts

@@ -113,7 +113,7 @@ describe("connector model enforcement", () => {
       status: "todo",
     });
 
-    db.setDisabledModels("openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
+    db.setDisabledModels(companyId, "openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
 
     const { taskRunner } = createOrchestrationHarness(db);
     const result = taskRunner.queueTaskRun(taskId, "manual", "board");
@@ -187,7 +187,7 @@ describe("connector model enforcement", () => {
     const checkoutSuccess = db.checkoutTask(taskId, run.id);
     expect(checkoutSuccess).toBe(true);
 
-    db.setDisabledModels("openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
+    db.setDisabledModels(companyId, "openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
 
     const { taskRunner } = createOrchestrationHarness(db);
     taskRunner.resumeQueuedRuns();

tests/integration/onboarding-model-pool.spec.ts

@@ -105,8 +105,6 @@ describe("onboarding model pool integration", () => {
       version: "test",
       lastError: null,
     });
-    db.setDisabledModels("openai-codex", [{ id: disabledModel, label: disabledModel }]);
-
     const summary = createBootstrapHarness(db).bootstrapOnboarding({
       companyName: "Model Governance Co",
       companyDescription: "Tests onboarding model governance",
@@ -118,6 +116,9 @@ describe("onboarding model pool integration", () => {
       goalDescription: "Ensure onboarding connector models flow into runtime decisions.",
       connectorId: "openai-codex",
       connectorModel: enabledModel,
+      connectorPoolSelections: [
+        { connectorId: "openai-codex", disabledModels: [{ id: disabledModel, label: disabledModel }] },
+      ],
     });
 
     if (!summary.leadAgentId) {
@@ -127,7 +128,7 @@ describe("onboarding model pool integration", () => {
     const agent = db.getAgent(summary.leadAgentId);
     expect(agent.connectorId).toBe("openai-codex");
     expect(agent.model).toBe(enabledModel);
-    expect(db.getDisabledModels("openai-codex")).toEqual([{ id: disabledModel, label: disabledModel }]);
+    expect(db.getDisabledModels(summary.companyId, "openai-codex")).toEqual([{ id: disabledModel, label: disabledModel }]);
     expect(db.getCurrentCompanyId()).toBe(summary.companyId);
 
     const payload = buildKickoffPayload(db, summary);
@@ -167,8 +168,6 @@ describe("onboarding model pool integration", () => {
       version: "test",
       lastError: null,
     });
-    db.setDisabledModels("anthropic", [{ id: disabledModel, label: disabledModel }]);
-
     const summary = createBootstrapHarness(db).bootstrapOnboarding({
       companyName: "Anthropic Governance Co",
       companyDescription: "Tests anthropic model governance",
@@ -180,6 +179,9 @@ describe("onboarding model pool integration", () => {
       goalDescription: "Ensure anthropic model pools survive onboarding and runtime prompt assembly.",
       connectorId: "anthropic",
       connectorModel: enabledModel,
+      connectorPoolSelections: [
+        { connectorId: "anthropic", disabledModels: [{ id: disabledModel, label: disabledModel }] },
+      ],
     });
 
     const payload = buildKickoffPayload(db, summary);
@@ -259,8 +261,6 @@ describe("onboarding model pool integration", () => {
       version: "test",
       lastError: null,
     });
-    db.setDisabledModels("openai-codex", [{ id: defaultModel, label: defaultModel }]);
-
     const summary = createBootstrapHarness(db).bootstrapOnboarding({
       companyName: "Default Reroute Co",
       companyDescription: "Tests runtime reroute when the connector default is disabled",
@@ -272,6 +272,9 @@ describe("onboarding model pool integration", () => {
       goalDescription: "Ensure runtime picks the first enabled model when connector default is disabled.",
       connectorId: "openai-codex",
       connectorModel: "",
+      connectorPoolSelections: [
+        { connectorId: "openai-codex", disabledModels: [{ id: defaultModel, label: defaultModel }] },
+      ],
     });
 
     const payload = buildKickoffPayload(db, summary);
@@ -300,8 +303,6 @@ describe("onboarding model pool integration", () => {
       version: "test",
       lastError: null,
     });
-    db.setDisabledModels("openai-codex", [{ id: disabledModel, label: disabledModel }]);
-
     expect(() => createBootstrapHarness(db).bootstrapOnboarding({
       companyName: "Rejected Model Co",
       companyDescription: "Tests invalid onboarding model rejection",
@@ -313,6 +314,9 @@ describe("onboarding model pool integration", () => {
       goalDescription: "Invalid explicit models should fail before the CEO is created.",
       connectorId: "openai-codex",
       connectorModel: disabledModel,
+      connectorPoolSelections: [
+        { connectorId: "openai-codex", disabledModels: [{ id: disabledModel, label: disabledModel }] },
+      ],
     })).toThrow(`${codexDefinition.label} does not allow model "${disabledModel}".`);
 
     db.close();