Run component-owned setup after agent-stack synchronizes repositories

Why

agent-stack sync currently clones or fast-forwards the three stack repositories and immediately installs their commands. It never runs repository-owned dependency setup. This allowed a dashboard checkout to update to code importing a newly locked package while retaining stale node_modules; source synchronization succeeded, but dashboard startup failed with ERR_MODULE_NOT_FOUND.

The stack orchestrator should own sequencing and reporting, while each trusted component owns its setup implementation.

Component contract issues:

• shakacode/agent-coordination-dashboard#175
• shakacode/agent-coordination#328

Requirements

• R1: Add a documented component setup phase after every repository has synchronized successfully and before command installation, doctors, or service restart.
• R2: Invoke a fixed repository-owned bin/setup entrypoint; do not infer package managers or accept arbitrary setup command strings from issue text or untrusted checkout configuration.
• R3: Give agent-workflows its own idempotent bin/setup contract, even if its current work is limited to runtime prerequisite verification.
• R4: Treat a missing required setup entrypoint or nonzero setup result as a sync failure naming the component and the corrective action.
• R5: Do not partially install newer commands after a setup failure. Preserve the existing dirty-checkout, trusted-origin, and --no-install safety behavior.
• R6: Define whether --no-install also skips setup; expose a separate explicit skip only if a demonstrated workflow requires it.
• R7: Report setup results in human output and component/master doctor evidence where useful.

Acceptance criteria

• A test fixture that fast-forwards to a new locked dependency runs component setup before installation and becomes runtime-ready.
• A failing setup prevents downstream installation and identifies the failing repository.
• Multi-component setup ordering and failure behavior are deterministic and tested.
• Repeated sync remains idempotent.
• Existing source-root, compatibility-link, host, delivery-mode, and no-fetch behavior remains compatible.
• User-facing full-stack setup and upgrade documentation describes the new phase.

Sequencing

Implementation should consume the component contracts from:

1. shakacode/agent-coordination-dashboard#175
2. shakacode/agent-coordination#328

The orchestrator may define and test its side of the contract first, but final integration evidence must use component revisions that actually provide bin/setup.

Non-goals

• Multi-machine topology or SSH orchestration; tracked separately.
• Running arbitrary repository-configured shell snippets.
• Starting or restarting services inside component setup.

Validation

Run the focused agent-stack tests and the full validation gate resolved through AGENTS.md and .agents/agent-workflow.yml. Include a regression fixture for the stale dependency state that motivated this issue.

Start with the focused agent-stack tests and the sequencing around repository synchronization, command installation, doctors, and service restart; read AGENTS.md and .agents/agent-workflow.yml for the validation gate. Review the component contracts in shakacode/agent-coordination-dashboard#175 and shakacode/agent-coordination#328, including their bin/setup requirements. Done means deterministic, idempotent setup and failure tests, preserved safety behavior, and updated full-stack setup and upgrade documentation.