orb(onboarding): chat-first first-run — install, pick a repo, guided dry-run review conversation, zero-human path

[JSONbored]

Context

Part of the ORB maintainer chat platform epic; do not start before the epic's spec sub-issue closes. The end vision's bar: a maintainer goes from "never heard of LoopOver" to a first agent-driven review conversation with zero human intervention — the Lovable/Cursor first-run feel. The self-serve building blocks are tracked in ORB Cloud Readiness (#4926 setup-wizard redesign, #4930 signup/checkout, #4931 human-free onboarding docs, #4927 install/deployment decoupling); this issue is the chat-first first-run experience stitched over them.

Requirements

1. First-run flow: sign in with GitHub → install the GitHub App on a chosen repo (or detect an existing install) → land directly in a guided first conversation scoped to that repo.
2. The guided first conversation is scripted-but-real: it grounds on the actual repo (real queue, real config) and walks the maintainer to one concrete first win — a dry-run review of a real open PR, then shows what the agent would have done and how to graduate dry-run → live per the autonomy settings.
3. Safe defaults, ratchet upward: onboarding never lands a repo in live actuation; dry-run (or observe) is the landing state, and each graduation step is an explicit, audited user action.
4. Empty-state handling defined for: repo with no open PRs, repo with no deployment (per Decouple "admin of a GitHub install" from "has a running container" #4927 alignment), and permission-declined installs — each reaches a useful next step, not a dead end.
5. Instrumentation: funnel events for each step (privacy-safe, PostHog per the observability standard) so activation is measurable.

Deliverables

• The first-run flow + guided conversation script/logic, feature-flagged off by default.
• Tests: flow-state machine coverage (all four empty/edge states above), safe-default assertions (landing state is never live actuation), funnel-event emission.

Expected outcome

The maintainer half of "start using LoopOver like you'd start using Lovable" exists: minutes from sign-in to watching the agent dry-run a real PR, with every graduation to autonomy explicit.

[linear-code]

JSO-6354