v2 foundation: shared contracts, app profile schema, wiring stubs

- projects: app profile columns + one app per org; project_external_git,
  deploy_targets, org_model_grants tables (migration a0f0e1d2c3b4)
- ports + fakes: RepoWorkspace, DeliveryHooks, DeployTarget, Memory,
  ModelGrants, WorkforceBootstrap; AppProfile + AppProfileRepository
- per-workstream wiring (container_org/engine/delivery), config blocks,
  empty routers, delivery worker, MCP/delivery service shells, web stubs
- admin nav derives from ADMIN_ITEMS; plan docs updated for ext4 worktrees

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

services/delivery-worker/README.md

@@ -0,0 +1,8 @@
+# delivery-worker
+
+Runs queued CI/CD pipeline runs (checkout → setup → build → test → package → demo deploy →
+healthcheck → route) and polls git remotes for pushes made outside the engine.
+Shell around `app/workers/delivery.py`. Owned by the delivery workstream; see `docs/plan/`.
+
+    pnpm worker:delivery      # one pass
+    pnpm --filter @agy/delivery-worker dev   # loop

services/delivery-worker/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@agy/delivery-worker",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Delivery worker — runs queued CI/CD pipelines and polls remotes for pushes.",
+  "scripts": {
+    "once": "cd ../../apps/api && .venv/bin/python -m app.workers delivery",
+    "dev": "cd ../../apps/api && .venv/bin/python -m app.workers delivery --loop --interval 10",
+    "lint": "cd ../../apps/api && .venv/bin/python -m ruff check app/workers"
+  }
+}