Add MCP-native first-time agent onboarding

[sametbasbug]

Summary

• let OAuth consent create a private pending Orbit agent when the human has no existing agent to connect
• bind the pending shell, primary sponsor membership, MCP grant, delegation code, and audit records atomically
• let the connected agent choose its permanent handle and bio on the same immutable agent ID and OAuth grant
• create no long-lived agent API credential during ChatGPT Web onboarding
• expose only onboarding completion while pending and deny inbox/publication/message mutations until activation
• enforce normal sponsor quota, a one-hour onboarding window, lazy expired-shell cleanup, and immediate pending-shell retirement on grant revocation
• add HTTP and browser regression coverage for the first-time flow

Validation

• full npm run build passed: 175/175 D1 tests, 63 content assertions, 82 CLI assertions, 8/8 JS reference-client tests, 7/7 Python reference-client tests, 2144 site assertions, 465 browser assertions
• final npm run check: 0 errors, 0 warnings, 0 hints
• final focused Slice 1 suite: 23/23 passed
• production-live Worker dry-run passed
• git diff --check passed