feat(onboarding): make a fresh install usable without pre-installed CLIs #995

Motivation

A clean-machine audit (three read-only explorers over the startup surface, 2026-09-18) found that a brand-new user who installs the DMG and double-clicks the app hits a hard dead-end: the SetupGate blocks until BOTH external provider CLIs exist, with zero in-app install guidance — while the underlying bundled-runtime infrastructure is actually excellent. The gap is concentrated in gate policy and first-run glue, not in the tooling.

Findings (ranked)

P0 — walls

1. Hard lockout with no escape: claude and codex are required: true (src/providers/registry.setup.ts:43,50); the gate has no Continue button while either is missing (SetupGate.tsx:154-163) and providers are installable: false (src/main/setup/prerequisites.ts:28-39) — no install command, link, or copy-paste. Even a terminal-pane-only user is locked out.
2. "open Setup to locate it" points at nothing: the gate cannot be reopened after launch (no menu/palette entry; sessionManager.ts:2586's toast cites a surface that doesn't exist post-launch). Manual tool-path override is gate-only.
3. Bootstrap races the gate: the fresh-install bootstrap spawns the first Claude agent under the gate (useBootstrap.ts:87-121), the spawn fails, leaving zero tabs AND bootstrapComplete false — which disables autosave and workspace adoption for the entire run (useBootstrap.ts:221-225, useAutoSave.ts:242).
4. First project cwd is / on Finder/Dock launches (ipc/workspace.ts:64-66 uses process.cwd()).

P1 — rough edges

5. No app self-update: electron-updater is not wired; release latest-mac.yml is inert builder output; beta users must reinstall DMGs manually.
6. Provider pickers offer uninstalled providers with no disabled/hint state (providerChoices.ts:32-55, PathPickerModal.tsx:315-335) — failure surfaces only after the user commits a cwd.
7. No login/onboarding detection for any provider: unauthenticated panes sit in "waiting for agent" indefinitely; OpenCode's structured runtime has no login surface at all.
8. TLDR peek (Cmd+L) silently dies without Accessibility (tldr/ipc.ts:24-31, holdRelease.ts:27-44) — flashes and closes with no explanation.
9. Dictation on the phone companion reads only DEEPGRAM_API_KEY env, ignoring the Settings-stored key (RemoteController.ts:196-223).

Already solid (do not redo)

• Bundled tmux/mitmproxy/cloudflared resolve with zero PATH dependence, manifest-pinned, noexec-probed, arch-thinned (runtimeTools.ts; CI packaging smoke).
• mitmproxy needs no certificate-trust step (NODE_EXTRA_CA_CERTS injection only, allow-listed host).
• Built-in MCP host uses an ephemeral port; external-control port failure is non-fatal.
• Offline behavior: version probes silently degrade; no telemetry exists.
• Spawn-time absolute-path-or-fail + late re-resolve for CLIs installed after the gate.

Proposed acceptance criteria

• A fresh install can reach a usable workspace with (a) bundled opencode (issue feat(setup): bundle the OpenCode CLI as a managed runtime binary #994) or (b) any single provider CLI, or (c) no provider at all (terminal pane), with an explicit, dismissible explanation instead of a lockout.
• The gate offers copyable install commands and links per provider, is reopenable from the menu/command palette, and hosts the manual path override persistently (also surfaced in Settings).
• The bootstrap never spawns a session while the gate blocks; a failed/absent first spawn does not disable persistence for the run.
• The default first project cwd is the user's home, never /.
• "open Setup to locate it" resolves to a real reopen action.
• (follow-up issue) App self-update via electron-updater consuming latest-mac.yml.

Refs #993, #994