refactor(cli): extract pure functions from onboard.js to typed TypeScript modules

[cv]

Summary

Extract pure, self-contained functions from bin/lib/onboard.js (~3,850 lines) into typed TypeScript modules under src/lib/. Each extraction converts CJS → ESM TS in one step, exercising the tsconfig.cli.json foundation from #913.

These extractions are independent of the #924 blockers (#781, #782, #819, #672, #634, #890) — none of the blocking PRs touch the functions listed below.

Motivation

onboard.js mixes pure logic (string parsing, state classification, URL validation) with side-effectful orchestration (gateway lifecycle, sandbox creation, user prompts). The pure functions can move to typed modules today without waiting for the blocker queue to clear, giving us:

• Type safety on the most testable parts of the CLI
• Smaller onboard.js (easier to review the remaining refactor(cli): shell consolidation, TypeScript migration & oclif #924 PRs)
• Real consumers of tsconfig.cli.json beyond the coverage ratchet script
• Incremental progress on refactor(cli): shell consolidation, TypeScript migration & oclif #924's shell consolidation goal

Extraction groups

Each group becomes one PR. Groups are independent and can land in any order.

Group 1: Gateway state classification (~50 lines → src/lib/gateway-state.ts)

Pure parsers of openshell status / openshell gateway list output. No I/O — they take strings in and return booleans or enums.

• getReportedGatewayName
• isGatewayConnected
• hasActiveGatewayInfo
• hasStaleGateway
• isSelectedGateway
• isGatewayHealthy
• getGatewayReuseState
• isSandboxReady
• getSandboxStateFromOutputs

Group 2: Validation & classification (~60 lines → src/lib/validation.ts)

Pure string matching — classify error types, validate key formats, check model IDs.

• classifyValidationFailure
• classifyApplyFailure
• classifySandboxCreateFailure
• validateNvidiaApiKeyValue
• isSafeModelId

Group 3: URL / string utilities (~40 lines → src/lib/url-utils.ts)

Pure string transformations for endpoint URLs, env var formatting, and policy preset parsing.

• stripEndpointSuffix
• normalizeProviderBaseUrl
• isLoopbackHostname
• compactText
• formatEnvAssignment
• parsePolicyPresetEnv

Group 4: Sandbox build context helpers (~30 lines → src/lib/build-context.ts)

Path filtering for Docker build context staging and failure classification for sandbox creation.

• shouldIncludeBuildContextPath
• copyBuildContextDir
• printSandboxCreateRecoveryHints

Group 5: Dashboard URL logic (~30 lines → src/lib/dashboard.ts)

Resolve dashboard forwarding targets and build control UI URLs from auth tokens.

• resolveDashboardForwardTarget
• buildControlUiUrls

Approach for each PR

1. Create new .ts file in src/lib/ with typed exports
2. onboard.js imports from the compiled JS output
3. Co-located .test.ts for the new module (tests that existed as inline assertions in runner.test.js or onboard.test.js migrate; new tests added where coverage is missing)
4. Verify npm test and make check pass

What this does NOT do

• Does not touch any function modified by fix: add local-inference policy preset for Ollama/vLLM host access (#693) #781, fix: add binaries to policy presets + safe config I/O (#676, #692, #606) #782, feat: add Podman as supported container runtime for macOS and Linux #819, fix(security): redact secret patterns from CLI log and error output #672, fix(cli): clear sandbox registry when gateway is destroyed during onboard (fixes: #532) #634, fix(onboard): run inference curl probes without shell expansion #890, or fix(security): bind Ollama to localhost instead of 0.0.0.0 #1140
• Does not introduce oclif (that's refactor(cli): shell consolidation, TypeScript migration & oclif #924 PR 3+)
• Does not create shared/types.ts (that comes with PR 1 when the blockers clear)
• Does not change any user-facing behavior

Relation to #924

This is incremental pre-work for #924's TypeScript migration. It reduces the size of onboard.js by ~210 lines and converts them to typed TS, making the eventual PR 1 rewrite smaller and less risky.

Supersedes nothing. Blocked by nothing. Can proceed immediately.