Scaffold agent permissions, approval comments, and hiring governance types

Add pending_approval agent status, permissions jsonb column, and AgentPermissions
type with canCreateAgents flag. Add approval_comments table and ApprovalComment
type. Extend approval statuses with revision_requested. Add validators for
permission updates, approval revision requests, resubmission, and approval
comments. Add requireBoardApprovalForNewAgents to company update schema.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/services/agent-permissions.ts

@@ -0,0 +1,27 @@
+export interface NormalizedAgentPermissions {
+  canCreateAgents: boolean;
+}
+
+export function defaultPermissionsForRole(role: string): NormalizedAgentPermissions {
+  return {
+    canCreateAgents: role === "ceo",
+  };
+}
+
+export function normalizeAgentPermissions(
+  permissions: unknown,
+  role: string,
+): NormalizedAgentPermissions {
+  const defaults = defaultPermissionsForRole(role);
+  if (typeof permissions !== "object" || permissions === null || Array.isArray(permissions)) {
+    return defaults;
+  }
+
+  const record = permissions as Record<string, unknown>;
+  return {
+    canCreateAgents:
+      typeof record.canCreateAgents === "boolean"
+        ? record.canCreateAgents
+        : defaults.canCreateAgents,
+  };
+}