[Improve] Make setup conversational and agent-led

[roomote-roomote]

​Created by Roomote. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Make first-admin setup conversational and agent-led while keeping setup actions in trusted UI cards.
• Offer optional integrations after source control is connected or declined, retain the Asked about integrations receipt, and preserve source-control and starter-work skip decisions across reloads.
• Suppress repository starter work and automation offers when no repositories are synchronized, and require a sandbox only when selected coding work needs one.
• Let the reconciled starter_selection turn exclusively own selected starter-task launches so a ready sandbox cannot cause the capability-response turn to launch the same work again.
• Preserve upstream Session-secret and Session-goal behavior while resolving the branch against current develop.

Why this change was made

Setup should adapt to what an administrator has already provided without coercive gates or repeated questions. Starter work also needs one durable launch owner so each selected task starts exactly once when compute is ready.

Impact

Administrators can connect or skip source control and integrations, start their own work, or select starter tasks without setup reopening skipped choices. When starter tasks are selected, setup waits for a usable sandbox and launches each selected task once; launch attempts can still complete setup even when an individual launch fails.

[roomote-community]

No new code issues found. See task

• Empty starter-task skips are preserved through state normalization and reconciliation (packages/types/src/setup-new.ts).
• Selecting starter work with a ready sandbox launches each selected task once (apps/web/src/trpc/commands/fast-sessions/index.ts:979).
• Capability offers require each requested integration's effective status to be connected (apps/web/src/app/(sandbox)/sessions/[sessionId]/CapabilityOfferCard.tsx:44).
• Embedded integration setup reconnects needs_connection integrations instead of treating deployment enablement as authentication (apps/web/src/components/settings/Integrations.tsx:2595).

_{Reviewed bc7fc4b}

[roomote-roomote]

Fixed the duplicate starter-work launch and resolved the branch against current develop in 6987241. Reconciliation now exclusively owns selected starter launches, and regression coverage confirms two selected tasks launch exactly twice across the reconciliation and response paths. Existing integration onboarding, the Asked about integrations plug receipt, and durable skip behavior remain intact. Focused setup tests, cloud-agent tests, package typechecks/lint, and the full pre-push gate pass.