feat: openlock setup + init onboarding wizards (bd openlock-lvc.1)

[vessux]

Summary

Two onboarding commands that make the golden path install → doctor → setup → init → validate → sandbox real, plus a behavior change that removes implicit .openlock/ scaffolding.

• openlock setup — machine-layer defaults → global config. Walks runtime (reuses runtime-wizard), a new harness picker, and provider (reuses login), persisting default_runtime/default_harness/default_provider. Closes the prior gaps where default_harness had no interactive setter and default_provider was read-only. Provider list is filtered to harness-compatible ids (filter lives only in setup — login standalone is unchanged). Re-runs preselect current values. Non-TTY prints a manual-config hint and exits 1.
• openlock init — project scaffold of .openlock/. Entry fork: write sensible defaults (also the non-TTY path) or guided Q&A. Emits an explicit, commented config.yaml with a real workdir mount (the fix for the empty-{} default), a harness-trimmed policy.yaml, and a seeded Containerfile. Gap-fill: on an incomplete folder, regenerates only the missing files and leaves hand-edited ones untouched. Refuses a complete folder unless --force. --harness overrides the scaffold harness.
• Shared scaffold core in config-core — pure scaffoldManifest / scaffoldPolicy generators next to the linters, guarded by a lint-clean invariant (generator output must pass lintManifest/lintPolicy, validated against the real default policy). Policy trim is registry-based (keeps the chosen harness + shared npm_packages/python_packages, drops the rest with a one-line pointer comment) so it scales to N harnesses.
• .openlock/ resolution is now complete-or-error. openlock sandbox no longer lazily scaffolds/restores; a missing or incomplete .openlock/ errors with "run openlock init". Deletes resolveFirstRun + all resolveRestored* paths + the empty-{} write. --policy <path> bypass is unchanged.

Both harness pickers derive options from HARNESSES (no hardcoded list), and init reads default_harness as a preselect, never enforcement.

Test plan

• bun run lint / bun run typecheck / bun run knip — all clean
• bun run test — 678 pass, 8 skip, 0 fail
• Unit: pure generators (incl. lint-clean invariant against the real policy), planInit modes, persistGlobalDefault, runSetup ordering + preselect + non-TTY, runInit fresh/gapfill/force/complete + guided
• Golden-path smoke: init (fresh → defaults) → validate ok; delete policy.yaml → init gap-fills only it → validate ok; sandbox on a folder with no .openlock/ → errors with the init hint
• openlock complete bash lists init + setup
• Reviewer: confirm CI green; smoke setup interactively on a real machine (runtime/harness/provider persist + idempotent re-run preselect)

Closes openlock-lvc.1 (rescoped to cover both commands). Unblocks openlock-lvc.4 (docs restructure).