v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -88,3 +88,37 @@ ERROR_LOG_ENABLED=1
 # genuine bugs. Turn it on while debugging a misbehaving client.
 # 5xx responses are always recorded, whatever this is set to.
 ERROR_LOG_CLIENT_ERRORS=0
+
+# ===========================================================================
+# v2 workstream settings. Each agent edits ONLY its own block.
+# ===========================================================================
+# >>> agent-1 (org platform)
+MCP_GATEWAY_HOST=127.0.0.1
+MCP_GATEWAY_PORT=8765
+MCP_TOKEN_TTL_DAYS=90
+MEMORY_ORG_CHAR_CAP=60000
+PLATFORM_INVITE_TTL_HOURS=72
+# <<< agent-1
+
+# >>> agent-2 (AI workforce engine)
+ENGINE_MAX_TOOL_CALLS_PER_TURN=40
+ENGINE_TURN_TIMEOUT_SECONDS=900
+ENGINE_MAX_CYCLES=6
+ENGINE_MAX_EMPLOYEES=20
+ENGINE_TICK_SECONDS=10
+# <<< agent-2
+
+# >>> agent-3 (delivery & infra)
+SANDBOX_DOCKER_BIN=docker
+SANDBOX_WORKSPACES_ROOT=./.data/workspaces
+SANDBOX_DEFAULT_CPUS=1
+SANDBOX_DEFAULT_MEMORY_MB=1024
+DEMO_PORT_START=8100
+DEMO_PORT_END=8999
+DELIVERY_POLL_SECONDS=60
+DEPLOY_ALLOW_PRIVATE_HOSTS=false
+ARTIFACTS_ROOT=./.data/artifacts
+# fake (default, no git on the host) | local (real git workspaces)
+GIT_WORKSPACE=fake
+ALLOW_CUSTOM_DOMAINS=false
+# <<< agent-3