refactor(onboard): reduce entrypoint to setup and wiring

## Ownership

@cv owns this issue.

Do not start, assign, or submit this work unless @cv transfers ownership in this issue.

## Problem

`src/lib/onboard.ts` still constructs and sequences state-specific behavior.

The entrypoint has broad mutable state and broad dependency contracts. This makes state ownership hard to test.

## Desired behavior

The entrypoint performs only:

- CLI and environment normalization;
- consent and session locking;
- context construction;
- dependency wiring;
- machine invocation;
- process-boundary cleanup.

Handlers own state-specific prompts, resume validation, repair decisions, and effects.

## Change boundary

Move one cohesive responsibility in each PR.

Use existing handlers and direct dependency contracts.

Do not add a framework, service locator, public API, or speculative extension point.

## Security

Keep credential values in process-local dependencies.

Do not place temporary paths, callbacks, or live handles in persisted context.

## Validation

- Test each extracted factory at its state boundary.
- Test dependency narrowing with compile-time types.
- Preserve fresh, resumed, failed, and paused transition traces.
- Test process cleanup and terminal failure ownership at the entrypoint boundary.

## Completion

`src/lib/onboard.ts` contains setup, context construction, dependency wiring, machine invocation, and process cleanup. It does not sequence state behavior.