refactor(model-pool): scope disabled-models by company; cascade on delete (v42)

The per-connector "enabled/disabled model" settings lived under a
global key in the settings key-value table
(`disabled_models:${connectorId}`). No company dimension. Deleting a
company left the pool choices behind, and creating a new company
silently inherited them — the visible symptom was "onboarding's team-
model configuration survives company deletion and pollutes the next
company's CEO model list."

Root fix, not a cleanup hook: the storage becomes a real relational
table with `(company_id, connector_id)` primary key and an
`ON DELETE CASCADE` FK from `companies`. Company deletion wipes pool
config by construction; no cleanup step in `deleteCompany()` can
drift.

Schema (migration v42):
- CREATE TABLE connector_model_pool_settings (company_id, connector_id,
  disabled_models_json, updated_at), PK (company_id, connector_id),
  FK companies(id) ON DELETE CASCADE.
- Drop every `settings.disabled_models:*` key — these were the bug's
  residue; there is no right company to attribute them to, so the
  migration clears them. Users re-select on next onboarding.

API surgery — every reader/writer now takes companyId:
- db.getDisabledModels(companyId, connectorId)
- db.setDisabledModels(companyId, connectorId, models)
- db.hasModelPoolSettings(companyId, connectorId)
- connector-model-policy: getConnectorModelPolicy(deps, companyId,
  connectorId); validateConnectorModelSelection(deps, companyId,
  connectorId, model)
- model-dispatch: listEnabledModels(companyId, deps);
  pickModelForAgent resolves companyId from agent.companyId
- orchestration heartbeat/task-runner/turn-context/run-dispatch pass
  the agent's or run's companyId through to the policy deps
- IPC schema: connectorDisabledModelsSchema gains companyId; new
  connectorModelPoolQuerySchema pairs companyId+connectorId for reads

Onboarding becomes commit-on-launch:
- useConnectorModelSelection no longer persists via IPC during
  onboarding. Toggles mutate local state; it exposes `poolSelections`
  to the wizard.
- bootstrapOnboardingSchema gains connectorPoolSelections. The
  onboarding service saves the company first, then persists each
  per-connector disabled list scoped to the new company id — CEO
  model validation runs against the company's freshly-persisted pool,
  not some stale global.
- IPC setConnectorDisabledModels now requires companyId; the only
  consumer was onboarding, which no longer calls it at all.
- Main-side listConnectorModels returns the raw provider catalog
  (no pool filtering), since that IPC is used from onboarding where
  no company exists yet; pool filtering happens at dispatch time.

saveConnector IPC drops the per-company pool validation — connector
config is a global hint, company-scoped enforcement belongs at run
dispatch where the company is known.

Tests: 603/603 green. Typecheck clean. Integration tests rewritten
to set the pool via connectorPoolSelections on bootstrap input, not
a pre-bootstrap global setDisabledModels call.

tests/unit/connector-model-policy.test.ts

@@ -12,13 +12,13 @@ function createDeps(overrides: {
       label: "Anthropic",
       model: overrides.connectorModel ?? null,
     }),
-    getDisabledModels: () => overrides.disabledModels ?? [],
+    getDisabledModels: (_c: string, _k: string) => overrides.disabledModels ?? [],
   };
 }
 
 describe("connector model policy", () => {
   it("excludes disabled models from the enabled set", () => {
-    const policy = getConnectorModelPolicy(createDeps(), "anthropic");
+    const policy = getConnectorModelPolicy(createDeps(), "test-co", "anthropic");
     const allIds = policy.enabledModels.map((model) => model.id);
     if (allIds.length === 0) {
       throw new Error("anthropic provider should expose at least one model from pi-ai.");
@@ -26,33 +26,31 @@ describe("connector model policy", () => {
 
     const firstModel = allIds[0];
     const filteredPolicy = getConnectorModelPolicy(
-      createDeps({ disabledModels: [{ id: firstModel, label: firstModel }] }),
-      "anthropic",
+      createDeps({ disabledModels: [{ id: firstModel, label: firstModel }] }), "test-co", "anthropic",
     );
 
     expect(filteredPolicy.enabledModels.some((model) => model.id === firstModel)).toBe(false);
   });
 
   it("accepts an explicit enabled model", () => {
-    const policy = getConnectorModelPolicy(createDeps(), "anthropic");
+    const policy = getConnectorModelPolicy(createDeps(), "test-co", "anthropic");
     const enabledId = policy.enabledModels[0]?.id;
     if (!enabledId) {
       throw new Error("anthropic provider should expose at least one model from pi-ai.");
     }
-    const result = validateConnectorModelSelection(createDeps(), "anthropic", enabledId);
+    const result = validateConnectorModelSelection(createDeps(), "test-co", "anthropic", enabledId);
 
     expect(result).toEqual({ ok: true, effectiveModel: enabledId });
   });
 
   it("rejects an explicit disabled model", () => {
-    const policy = getConnectorModelPolicy(createDeps(), "anthropic");
+    const policy = getConnectorModelPolicy(createDeps(), "test-co", "anthropic");
     const enabledId = policy.enabledModels[0]?.id;
     if (!enabledId) {
       throw new Error("anthropic provider should expose at least one model from pi-ai.");
     }
     const result = validateConnectorModelSelection(
-      createDeps({ disabledModels: [{ id: enabledId, label: enabledId }] }),
-      "anthropic",
+      createDeps({ disabledModels: [{ id: enabledId, label: enabledId }] }), "test-co", "anthropic",
       enabledId,
     );
 
@@ -75,8 +73,8 @@ describe("native connector defaults", () => {
         label: "Codex",
         model: null,
       }),
-      getDisabledModels: () => [],
-    }, "openai-codex");
+      getDisabledModels: (_c: string, _k: string) => [],
+    }, "test-co", "openai-codex");
 
     expect(policy.defaultModel).toBe(configuredDefault);
     expect(validateConnectorModelSelection({
@@ -85,8 +83,8 @@ describe("native connector defaults", () => {
         label: "Codex",
         model: null,
       }),
-      getDisabledModels: () => [],
-    }, "openai-codex", null)).toEqual({
+      getDisabledModels: (_c: string, _k: string) => [],
+    }, "test-co", "openai-codex", null)).toEqual({
       ok: true,
       effectiveModel: configuredDefault,
     });

tests/unit/ipc-agent-graph-handlers.test.ts

@@ -38,13 +38,12 @@ describe("ipc-core-agent-graph-handlers model enforcement", () => {
       version: "test",
       lastError: null,
     });
-    db.setDisabledModels("openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
-
     const companyId = db.saveCompany({
       name: "Handler Test Co",
       description: "Tests saveAgent model validation",
       status: "active",
     });
+    db.setDisabledModels(companyId, "openai-codex", [{ id: "gpt-5.4", label: "gpt-5.4" }]);
     const workspaceId = db.saveWorkspace({
       companyId,
       name: "Primary",