Workbench Definition owns template create; Code review onboards in an empty channel with no host

[TheGreatAxios]

Closes CL-7100, CL-7099 (parent CL-7098).

What changed

One type describes a template. WorkbenchDefinition (arktype, @corbits/workflow-catalog) — default agents, routines, tools, plugins {required, optional}, and ordered onboarding steps (connect-plugin → pick-github-repos → start-webhook-trigger). Validation fails loud when a required plugin has no connect step, a step names something the definition doesn't carry, or the walkthrough is out of order. The three shipped manifests are that type; no aliases for the old WorkbenchTemplateManifest names.

Create-from-template instantiates the definition, then runs its onboarding steps. instantiateWorkbenchTemplate gains a typed beginOnboarding(steps) port and drops its "todo" notes about webhook triggers. The web flow mints an empty kind: "workbench" channel with no host, instantiates, then posts the walkthrough into the room.

The card is posted by a route, not as a side effect of hosting an agent. @corbits/chat gains POST /workbenches/:id/onboarding, which posts a connect-github block from a system@<workbenchId> sender carrying the definition's title, promise, and step labels. The templatePromise / connectGithubRequiredFor create-body fields and the greet-then-card branch of the hosted mint are removed. Settling a credential a template room waits on posts the connected event from the system address and never wakes an agent.

Code review is three reviewers and a GitHub walkthrough — no Myra. The /new "already connected → pick repos in a dialog" path is deleted: the in-room card reads connected state live and flips straight to the repo pick, so there is one walkthrough, not two.

Verification

bun run check green (typecheck, lint, 6518 tests, structural). New tests: empty-channel onboarding route (system sender, no agent launched), settle never wakes an agent for template-only matches, definition round-trip and every fail-loud rule, instantiation hands the three steps to beginOnboarding in order and never invites Myra, web create flow POSTs /onboarding with GitHub disconnected and connected alike.

Notes for review

• GTM declares connect steps for attio/exa that the web binding cannot run yet; it is not offered by the picker and instantiation already throws for it — both throws are the honest state.
• apps/web copy says "workbench template" rather than "definition" in one throw because check:ui-vocabulary bans the word in user-visible strings.