Test that onboarding finishes as "pastes manually" when Accessibility is not granted

## What happens

`Sources/UttrflowUX/OnboardingFlow.swift:377-382`, `readiness()`, decides how onboarding ends: `.needsMicrophone`, `.needsSpeechModel`, `.pastesManually` or `.ready`. The `.pastesManually` return on line 380 (microphone granted and model installed, but Accessibility denied) has never run. Line 325's `guard let self` in a callback is also unexercised.

Measured on origin/main `26d7bc1` with `swift test --enable-code-coverage` (5,384 tests, all passing) and `xcrun llvm-cov export` over the test binary. The regions named below have an execution count of 0: no test runs them, so a change that breaks them passes `make verify`.

## Why it matters

Declining Accessibility is a common, legitimate choice. The app still works, but has to paste rather than type. If this branch is broken, onboarding claims "ready" and the first dictation fails to insert with no explanation, or onboarding asks for a permission the user already refused.

## How to reproduce

Run `swift test --enable-code-coverage`, then `xcrun llvm-cov show -instr-profile .build/debug/codecov/default.profdata .build/debug/UttrflowPackageTests.xctest/Contents/MacOS/UttrflowPackageTests Sources/UttrflowUX/OnboardingFlow.swift` and look for the `0` counts on the lines named above.

## Acceptance criteria

- A test finishes onboarding with `FakePermissionGate` granting the microphone and denying Accessibility, and an installer reporting installed. It expects the finish to report `.pastesManually`.
- The same test with Accessibility granted expects `.ready`, so the two are told apart.
- Each new test fails when the branch it covers is broken. Check this by hand before opening the PR: temporarily change the branch (flip the condition or return the other value), see the test fail, then restore it.

## Where to start

- `Tests/UttrflowUXTests/OnboardingFlowTests.swift` (suite "Onboarding flow") and `Tests/UttrflowUXTests/OnboardingSupport.swift`.
- `Sources/UttrflowTestSupport/FakePermissionGate.swift`.

Read `CONTRIBUTING.md` first. Iterate with `swift test --filter `, then run `make verify` before pushing. Only tests change; no product code needs to.

**Size:** S, under an hour.

Read CONTRIBUTING.md, then inspect the "Onboarding flow" suite in Tests/UttrflowUXTests/OnboardingFlowTests.swift and its support files, including FakePermissionGate.swift. Run the focused swift test filter first. Done means coverage distinguishes denied Accessibility as .pastesManually from granted Accessibility as .ready, the tests fail when those branches are flipped, and make verify passes.

Written by the indexing model from the issue text.