feat(integration): wire v2 workstreams together (engine policy/budget, sandbox, tenant checks, order route, docs)

Engine honours org policy and monthly budget, legacy runner skips engine tasks,
sandbox session provisioned on demand, project fallback for threads, reviewer
fallback, tenant checks on project ids, memory reflection respects grants,
expiry worker, MCP pipeline_status, login redirect, sharing settings, e2e smoke.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

apps/api/app/interfaces/mcp/gateway.py

@@ -152,7 +152,7 @@ TOOL_SPECS: tuple[ToolSpec, ...] = (
     ToolSpec(
         name="pipeline_status",
         scope="delivery:read",
-        description="وضعیت خط تحویل (استقرار و دمو). در این نسخه در دسترس نیست.",
+        description="وضعیت خط تحویل (استقرار و دمو).",
         parameters={
             "type": "object",
             "properties": {},
@@ -562,8 +562,52 @@ async def _knowledge_search(
 async def _pipeline_status(
     gateway: McpGateway, *, session, identity: TokenIdentity, **_ignored: Any
 ) -> dict[str, Any]:
-    """Delivery is another workstream's table; the tool exists and says so."""
-    return {"available": False, "message": "خط تحویل در این نسخه در دسترس نیست."}
+    """The organization's delivery state: demo runtime, last runs, last production deploy.
+
+    Rule 7: the answer says where things stand and nothing about the infrastructure
+    under it. No port, container id, deploy-target host or log tail is ever returned.
+    """
+    from app.infrastructure.repositories.app_profile import AppProfileRepository
+    from app.infrastructure.repositories.delivery import (
+        AppRuntimeRepository,
+        PipelineRunRepository,
+        ProductionDeployRepository,
+    )
+
+    org_id = identity.organization_id
+    profile = await AppProfileRepository(session).get_for_org(org_id)
+    if profile is None:
+        return {"available": False, "message": "اپلیکیشنی برای این سازمان یافت نشد."}
+    project_id = profile.project_id
+    runtime = await AppRuntimeRepository(session).get_for_org(org_id, project_id)
+    runs = await PipelineRunRepository(session).list_for_project(
+        organization_id=org_id, project_id=project_id, limit=5
+    )
+    deploys = await ProductionDeployRepository(session).list_for_project(
+        project_id=project_id, limit=1
+    )
+    return {
+        "available": True,
+        "demo_url": runtime.demo_url if runtime else "",
+        "runtime_status": runtime.status if runtime else None,
+        "runs": [
+            {
+                "id": run.id,
+                "status": run.status,
+                "trigger": run.trigger,
+                "branch": run.branch,
+                "sha": run.sha[:12],
+                "error_summary": run.error_summary,
+                "created_at": run.created_at.isoformat(),
+            }
+            for run in runs
+        ],
+        "last_production_deploy": (
+            {"status": deploys[0].status, "created_at": deploys[0].created_at.isoformat()}
+            if deploys
+            else None
+        ),
+    }
 
 
 _HANDLERS: dict[str, Callable[..., Awaitable[dict[str, Any]]]] = {