v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/workers/__main__.py

@@ -3,6 +3,7 @@
     python -m app.workers billing [--loop --interval 3600]
     python -m app.workers ai-runtime [--loop --interval 30 --limit 10]
     python -m app.workers sandbox-gateway [--loop --interval 600 --idle-minutes 120]
+    python -m app.workers delivery [--loop --interval 10 --limit 10]
 
 Default is **one pass and exit**, which is the shape a cron entry wants. Pass
 ``--loop`` for a long-running deployment; SIGINT/SIGTERM then stop it cleanly.
@@ -24,7 +25,7 @@ def _build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="app.workers", description="AGY background workers")
     parser.add_argument(
         "worker",
-        choices=["billing", "ai-runtime", "sandbox-gateway"],
+        choices=["billing", "ai-runtime", "sandbox-gateway", "delivery"],
         help="which worker to run",
     )
     parser.add_argument("--loop", action="store_true", help="keep running instead of one pass")
@@ -92,12 +93,25 @@ def _sandbox_gateway_pass(args: argparse.Namespace):
     return one_pass
 
 
+def _delivery_pass(args: argparse.Namespace):
+    from app.workers.delivery import DeliveryWorker
+
+    worker = DeliveryWorker()
+
+    async def one_pass() -> WorkerOutcome:
+        return await worker.run_pass(limit=args.limit)
+
+    return one_pass
+
+
 def _pass_function(args: argparse.Namespace):
     """Return a zero-argument coroutine function for one pass."""
     if args.worker == "billing":
         return _billing_pass(args)
     if args.worker == "ai-runtime":
         return _ai_runtime_pass(args)
+    if args.worker == "delivery":
+        return _delivery_pass(args)
     return _sandbox_gateway_pass(args)
 
 

apps/api/app/workers/delivery.py

@@ -0,0 +1,15 @@
+"""Delivery worker — executes queued CI/CD pipeline runs and polls remotes for pushes.
+
+Owned by Agent 3 (see docs/plan/PLAN-v2.md). Foundation stub: one no-op pass.
+"""
+
+from __future__ import annotations
+
+from app.workers.base import WorkerOutcome
+
+
+class DeliveryWorker:
+    name = "delivery"
+
+    async def run_pass(self, *, limit: int = 10) -> WorkerOutcome:
+        return WorkerOutcome(name=self.name)