feat(onboarding): add natural-language initialization

[qwerfunch]

Summary

• make clad setup an explicit project-scoped activation instead of machine-global host injection
• wire Claude Code, Codex, Antigravity, and Cursor through project discovery files and a portable local MCP launcher
• keep setup-only projects inert: ordinary work cannot initialize Cladding, and mutating tools fail closed before a valid spec exists
• require explicit Cladding naming, a read-only preview, an exact staged draft, and a separate one-time approval before authored files are written
• persist only the approved draft in ignored project runtime so process-per-turn hosts cannot lose or reinterpret it
• migrate provably Cladding-owned 0.8.3 global wiring while preserving ambiguous or hand-edited host configuration
• use AGENTS.md as the shared managed instruction surface; preserve existing CLAUDE.md and never create one
• update install/update guidance, diagnostics, generated host integrations, onboarding spec, and empirical dogfood records

Why this is safer than 0.8.3

0.8.3	This PR
global wiring could enter unrelated host sessions	projects without clad setup receive no Cladding project wiring
host availability could be confused with activation	CLI installation and per-project activation are separate
natural language could route too eagerly	initialization requires the user to name Cladding explicitly
initialization could write immediately	prepare and stage do not author project files; apply requires a separate exact approval
a restarted host could lose its generated draft	the exact staged draft survives process-per-turn hosts in ignored project runtime
approval text could be reinterpreted as a new intent	approval is pattern-validated and can apply only the previously staged draft
cleanup risked user configuration	only provably owned legacy entries are removed; ambiguous entries are reported and preserved

Install and update UX

npm install -g cladding
cd <project>
clad setup
# Start a new supported AI-host session from this project.

npm install -g can run anywhere and installs only the CLI. clad setup runs once in each project that should expose Cladding. clad update refreshes both project wiring and derived state.

Packed-tarball host campaign (2026-07-16)

The definitive campaign installed the packed 0.9.0 tarball in isolation and drove real init scenarios through all five host CLIs across plain control, setup-only control, idea initialization, complete-document initialization, existing-code adoption, and legacy migration. Full report: docs/dogfood/e2e-0.9.0-packed-2026-07-16.md.

Host	Result
Claude Code	verified — full gate, live consent boundary held (weekly quota released early, so it ran)
Codex CLI	verified — full gate; drove the process-per-turn draft-staging fix in this PR
Antigravity CLI	verified — full gate; user config restored byte-for-byte
Gemini CLI	honest fail — personal tier ended (IneligibleTierError), recorded not-run
Cursor Agent	honest fail — usage limit, recorded not-run

The consent boundary held on every host that ran: even with permissions bypassed, each host stopped and refused paraphrased approval. clad doctor --hosts was modernized to probe this project-local model, so the shipped diagnostics match the campaign.

Defects found and fixed by the campaign

• Setup wires only detected hosts by default — previously every project received all five hosts' config regardless of what was installed; clad setup --host all remains the explicit override. (The old setup shard's twelve dangling test refs were rewritten.)
• Antigravity actually connects now — agy reads MCP config machine-wide only (a negative control proved the project file is never loaded), so setup also writes an ownership-guarded ~/.gemini/config/plugins/cladding/ wire — the one stated exception to project-local activation.
• clad update outside a cladding project writes nothing — it used to scaffold host wiring into any directory and could reach an account-wide legacy plugin uninstall.
• Abandoned onboarding preparations no longer accumulate — expired consent-cache envelopes are swept on staging (hundreds had piled up), and a tampered staged draft is re-validated and rejected cleanly instead of crashing.
• Legacy cleanup preserves your global config formatting — the codex config.toml entry is spliced out textually (comments/ordering survive, parse-verified), and cursor cleanup no longer leaves an orphan empty mcpServers.
• clad doctor --hosts probes match the project-local model — project-MCP approval for the consented Claude probe, project-directory Antigravity probe, Codex approvals bypass, and a realistic gate timeout.

Legacy 0.8.3 migration was tested separately: owned entries were removed, unrelated entries retained, ambiguous wrappers preserved and reported, and a second run stayed safe.

Also changed

• The deterministic collector found nine onboarding commit subjects that do not name a spec feature. Their user-visible behavior is covered by the spec-backed changes above, but their commit-to-spec linkage remains absent — recorded honestly rather than back-filled.

Verification

• npm run typecheck: passed
• npm run lint: passed
• npm test: 237 files, 2,561 tests passed
• node bin/clad sync: 255 feature shards valid
• node bin/clad check: all functional stages green
• git diff --check: passed
• working tree clean; branch is a clean superset of develop (28 commits ahead, 0 behind)