First-run activation menu + bundled dbt sample project

## Problem

After the first-run auth + scan-gate flow, a user who dismisses the
scan or lands on an empty environment ends up staring at an
unqualified chat prompt. There's no guided next action, no way to try
Altimate without connecting a real warehouse, and no built-in demo
project to reason against.

## What we want

1. **Guided activation** — after every branch of `/onboard-connect`, the
agent emits a short JTBD menu (see downstream / review a SQL PR / try
the sample project / describe your own). Warehouse-connected users
get a personalized variant with cost-analysis.
2. **Bundled sample dbt project** — a shipped jaffle-shop DuckDB project
the user can launch without any credentials. Idempotent materialize
to the user's home, versioned marker so future CLI upgrades can
detect stale copies.

## Acceptance

- Scan-gate "No" leads to a menu, not an empty prompt.
- "Try the sample project" materializes a working dbt project offline.
- Sample-mode follow-up menu points at concrete jobs (`dbt build`,
downstream impact, SQL review) that work against the sample.
- No credentials required until the user picks "Connect your own".