feat: unified first-run flow — merge wizard + gateway install (IUH-M03)

Collapse `mosaic wizard` and `mosaic gateway install` into a single cohesive
first-run experience. Gateway config and admin bootstrap now run as terminal
stages of `runWizard`, sharing `WizardState` with the framework stages and
eliminating the fragile 10-minute `$XDG_RUNTIME_DIR/mosaic-install-state.json`
session-file bridge.

- Extract `gatewayConfigStage` and `gatewayBootstrapStage` as first-class
  wizard stages with full spec coverage (headless + interactive paths).
- `mosaic gateway install` becomes a thin wrapper that invokes the same
  two stages — the CLI entry point is preserved for operators who only
  need to (re)configure the daemon.
- Honor explicit `--port` override even on resume: when the override
  differs from the saved GATEWAY_PORT, force a config regeneration so
  `.env` and `meta.json` cannot drift.
- Honor `state.hooks.accepted === false` in the finalize stage and in
  `mosaic-link-runtime-assets`: declined hooks are now actually opted-out,
  with a stable `mosaic-managed: true` marker in the template so cleanup
  survives template updates without touching user-owned configs.
- Headless rerun of an already-bootstrapped gateway with no local token
  cache is a successful no-op (no more false-positive install failures).
- `tools/install.sh` calls `mosaic wizard` only — the follow-up
  `mosaic gateway install` auto-launch is removed.

Closes mosaicstack/mosaic-stack#427.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/install.sh

@@ -423,15 +423,18 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
   if [[ ! -f "$MOSAIC_HOME/SOUL.md" ]]; then
     echo ""
     if [[ "$FLAG_NO_AUTO_LAUNCH" == "false" ]] && [[ -t 0 ]] && [[ -t 1 ]]; then
-      # Interactive TTY and auto-launch not suppressed: run wizard + gateway install
-      info "First install detected — launching setup wizard…"
+      # Interactive TTY and auto-launch not suppressed: run the unified wizard.
+      # `mosaic wizard` now runs the full first-run flow end-to-end: identity
+      # setup → runtimes → hooks preview → skills → finalize → gateway
+      # config → admin bootstrap. No second call needed.
+      info "First install detected — launching unified setup wizard…"
       echo ""
 
       MOSAIC_BIN="$PREFIX/bin/mosaic"
 
       if ! command -v "$MOSAIC_BIN" &>/dev/null && ! command -v mosaic &>/dev/null; then
         warn "mosaic binary not found on PATH — skipping auto-launch."
-        warn "Add $PREFIX/bin to PATH and run: mosaic wizard && mosaic gateway install"
+        warn "Add $PREFIX/bin to PATH and run: mosaic wizard"
       else
         # Prefer the absolute path from the prefix we just installed to
         MOSAIC_CMD="mosaic"
@@ -439,28 +442,19 @@ if [[ "$FLAG_CHECK" == "false" ]]; then
           MOSAIC_CMD="$MOSAIC_BIN"
         fi
 
-        # Run wizard; if it fails we still try gateway install (best effort)
         if "$MOSAIC_CMD" wizard; then
           ok "Wizard complete."
         else
-          warn "Wizard exited non-zero — continuing to gateway install."
-        fi
-
-        echo ""
-        info "Launching gateway install…"
-        if "$MOSAIC_CMD" gateway install; then
-          ok "Gateway install complete."
-        else
-          warn "Gateway install exited non-zero."
-          echo "  You can retry with: ${C}mosaic gateway install${RESET}"
+          warn "Wizard exited non-zero."
+          echo "  You can retry with: ${C}mosaic wizard${RESET}"
+          echo "  Or run gateway install alone: ${C}mosaic gateway install${RESET}"
         fi
       fi
     else
       # Non-interactive or --no-auto-launch: print guidance only
       info "First install detected. Set up your agent identity:"
-      echo "  ${C}mosaic init${RESET}     (interactive SOUL.md / USER.md setup)"
-      echo "  ${C}mosaic wizard${RESET}   (full guided wizard via Node.js)"
-      echo "  ${C}mosaic gateway install${RESET}   (install and start the gateway)"
+      echo "  ${C}mosaic wizard${RESET}   (unified first-run wizard — identity + gateway + admin)"
+      echo "  ${C}mosaic gateway install${RESET}   (standalone gateway (re)configure)"
     fi
   fi