feat: first-run activation — project-aware scaffold, router front door, onboarding nudges

Adds the activation system that drives a new install toward a concrete first move:
- bin/gstack-first-task-detect: local-git+filesystem repo classifier emitting one
  validated enum bucket (greenfield/code_<lang>/branch_ahead/dirty_default/clean_default),
  portable timeouts, fail-safe empty output.
- generate-first-run-guidance.ts: unified preamble section — first-run project-aware
  scaffold + returning-session plan->review->ship tip, gated on a persistent .activated
  marker and never run in headless. Detection wired lazily in generate-preamble-bash.ts.
- SKILL.md.tmpl: top-level gstack skill is now a pure router (browse body removed; it
  lives in /browse), routing any request and sending browser/QA work to /browse.
- setup: first-move nudge on first install. office-hours: closing handoff that launches
  the next review via the Skill tool.
- telemetry-ingest: accept onboarding/first_task_scaffold_shown/handoff/route event types.

supabase/functions/telemetry-ingest/index.ts

@@ -67,8 +67,18 @@ Deno.serve(async (req) => {
       // Validate schema version
       if (event.v !== 1) continue;
 
-      // Validate event_type
-      const validTypes = ["skill_run", "upgrade_prompted", "upgrade_completed"];
+      // Validate event_type. Activation-funnel events (v1.x) join the originals:
+      // onboarding (P0 setup nudge), first_task_scaffold_shown (P4 first-run
+      // scaffold), handoff (P1 office-hours → next skill), route (gstack router).
+      const validTypes = [
+        "skill_run",
+        "upgrade_prompted",
+        "upgrade_completed",
+        "onboarding",
+        "first_task_scaffold_shown",
+        "handoff",
+        "route",
+      ];
       if (!validTypes.includes(event.event_type)) continue;
 
       rows.push({