Summary

Follow up to #6166 by extracting the remaining sandbox prebuild/create/registration orchestration from the top-level src/lib/onboard.ts entrypoint into focused modules under src/lib/onboard/.

Motivation

PR #6166 substantially simplified its original implementation, but its final integration still adds 27 net lines to src/lib/onboard.ts. The codebase growth guard intentionally requires this top-level composition file to remain net-neutral or smaller.

The orchestration should have a clear owner without reintroducing shared timing registries, duplicated seams, or a second execution path.

Scope

• Extract non-interactive progress configuration from the top-level entrypoint, preferably without mutable process-global state.
• Encapsulate the BuildKit prebuild, launch-argument handoff, resolved image identity, and sandbox registration coordination behind a focused onboarding boundary.
• Keep the local Docker-driver eligibility check, filtered Docker environment, exact staged-Dockerfile guard, and safe OpenShell fallback behavior.
• Preserve the stateless 30-second heartbeat behavior across fresh, resume, and repair onboarding flows.
• Keep recovery hints aligned with the effective --from image.
• Link the transitional prebuild module and its call site to this issue with observable removal criteria.
• Update focused tests without restoring the removed timing registry, aggregate summary, duplicated test seams, or dedicated CI job.

Acceptance criteria

• src/lib/onboard.ts satisfies the codebase growth guard without a budget waiver.
• User-visible behavior from perf(onboard): build sandbox image with BuildKit + no-silent-progress heartbeats (#6002) #6166 remains unchanged.
• BuildKit failures and ineligible environments still fall back to the existing OpenShell build.
• Sandbox registration persists the exact build-qualified image identity.
• Targeted onboarding, sandbox prebuild, recovery-hint, and workflow-contract tests pass.
• CLI type-check and relevant repository guardrails pass.
• Any retained transitional path states when it can be removed and links to the tracking work.

Non-goals

• Changing onboarding UX or heartbeat cadence.
• Expanding BuildKit prebuild support beyond the local Docker-driver gateway.
• Introducing new global or singleton progress state.