Delete the workbench CLI; seed at hub boot (CL-7382)

[TheGreatAxios]

Replaces the workbench CLI's setup/seed/reset verbs with boot-time seeding and two thin root scripts, then deletes the package.

What each verb became

• workbench setup → the tenant/roles/admin-membership half was already handled by ensureDefaultTenant at hub boot (predates this PR). The remaining piece — publishing the corbits-tools registry onto the root tenant — moves into apps/hub/src/system-seed.ts, which now publishes it on every boot (content-addressed; a re-publish of an unchanged tarball is a no-op).
• workbench seed → apps/hub/src/system-seed.ts's runSystemSeed, scheduled once the hub's real HTTP server starts listening (Bun.serve, not the in-process fetch shortcut env-credential-plant.ts uses — seedTenant's workflow push shells out a real git push over HTTP, so it needs a reachable origin). It signs in as the same administrator identity (HUB_ADMIN_EMAIL/HUB_ADMIN_PASSWORD, same defaults), resolves the root tenant, then runs the same seedTenant → seedCatalog → ensureDefaultRoutines sequence the CLI ran, using the hub's own config.seedModel (a real key) or a placeholder when ANTHROPIC_API_KEY is unset — identical to the CLI's own fallback. The deploy step polls with a 60s bounded deadline (mirroring scripts/e2e/local-rip.test.ts's own retry loop) since it needs a connected sidecar; a failure past the deadline is logged and left for the next boot — every step is ensure-then-create, so retrying is safe. WORKBENCH_SEED_CATALOG_TEST_WORKFLOWS, a CLI-only dev/CI opt-in with no other consumer in the repo, was dropped rather than carried into hub config.
• workbench reset → root script bun run reset (scripts/reset.ts), same as before minus the CLI wrapper; bun run setup now calls scripts/db-setup.ts directly.

ensureDefaultRoutines and findPersonalTenant are newly exported from @workbench/hub-client and @workbench/onboarding respectively so system-seed.ts can reuse them instead of reimplementing.

Net LOC

232 insertions(+), 2192 deletions(-) across this PR's 3 commits (stacked on #579).

Testing

• bun run typecheck, check:licenses, generate-tsconfig-references.ts --check, check:browser-safe-subpaths all pass.
• bun test packages/hub-client packages/onboarding apps/hub/src — 445 pass, 0 fail.
• scripts/e2e/local-rip.test.ts against a local Postgres: fails on both this branch and its base (cl-7381-delete-echo) with a pre-existing check:tool-package-freshness false positive (no origin/main ref available in this worktree to diff against) — unrelated to this change.
• CLI-argument-only tests (packages/cli/test/{config,helpers,reset,setup}.test.ts) were deleted outright; the CLI-specific seed.ts wrapper tests were not ported 1:1 — the underlying primitives (seedTenant, seedCatalog, ensureDefaultRoutines) remain covered in packages/hub-client/test/, and scripts/e2e/local-rip.test.ts exercises the real end-to-end seed path.

Resolves CL-7382