feat(setup): optional WhatsApp wiring + cross-channel UX polish

WhatsApp (community/Baileys) joins the setup:auto channel picker, with
the same clack-native UX discipline as Telegram and Discord:

- setup/channels/whatsapp.ts — driver. Collects auth method (QR terminal
  or pairing code), runs the auth step, renders QR blocks in-place with
  ANSI cursor-rewind on rotation so the terminal doesn't fill up with
  stale codes, reads creds.me.id for the bot phone, restarts the service,
  asks for the operator's personal phone (defaulting to the authed
  number), writes ASSISTANT_HAS_OWN_NUMBER=true when they differ
  (dedicated mode), and hands off to init-first-agent.

- setup/whatsapp-auth.ts — forked standalone auth step. Channels-branch
  version had a browser-QR path with an HTTP server + <canvas> QR
  renderer; stripped entirely (headless/SSH users hit dead ends too
  often, and the extra deps complicate install). The remaining terminal
  QR emits raw QR strings in WHATSAPP_AUTH_QR blocks so the parent
  driver owns the rendering. Pairing-code path retained. Status blocks
  now use the runner's vocabulary (success/skipped/failed) so spawnStep
  sets ok correctly; WhatsApp-specific UI text ("WhatsApp linked", "You
  chat") lives in the driver.

- setup/add-whatsapp.sh — non-interactive installer, mirror of
  add-telegram.sh. Fetches the adapter + groups step from the channels
  branch (whatsapp-auth.ts stays local, pair-telegram.ts pattern),
  installs pinned baileys/qrcode/pino, registers the steps in
  setup/index.ts's STEPS map. No service restart (adapter factory
  returns null until creds exist).

Cross-channel fixes bundled:

- scripts/init-first-agent.ts: always addMember(user, agentGroup) for
  the target user so subsequent wirings (not the first) pass the access
  gate. Telegram wiring first → Discord/WhatsApp second was dropping
  every inbound with accessReason='not_member' because only the first
  user gets owner. namespacedPlatformId also passes through JID-format
  raws (contains '@') so WhatsApp's bare <phone>@s.whatsapp.net matches
  what the adapter stores.

- setup/service.ts: launchctl unload-then-load instead of bare load (bare
  load errors 'already loaded' when a prior plist was cached, keeping
  launchd on the OLD ProgramArguments even after the file on disk
  changed). systemctl start → restart (start is a no-op on an active
  unit, swallowing unit-file edits).

- setup/add-telegram.sh: removed the in-script open "tg://resolve"
  block. The driver (setup/channels/telegram.ts) now owns the deep-link,
  gated on a p.confirm so the browser can't steal focus unexpectedly.

- setup/channels/discord.ts + setup/channels/telegram.ts: every browser
  open goes through confirmThenOpen (new shared helper in
  setup/lib/browser.ts) — operator presses Enter before their browser
  takes focus. Telegram switched from tg://resolve?domain= to
  https://t.me/<bot> which works everywhere.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/add-telegram.sh

@@ -119,7 +119,8 @@ else
 fi
 
 # Look up the bot username (auto.ts already validated; we re-query here so
-# standalone invocations still work).
+# standalone invocations still work — BOT_USERNAME is emitted in the status
+# block for parent drivers to display).
 INFO=$(curl -fsS --max-time 8 \
   "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/getMe" 2>/dev/null || true)
 BOT_USERNAME=""
@@ -131,23 +132,10 @@ fi
 mkdir -p data/env
 cp .env data/env/env
 
-# Deep-link into the bot's chat so the user is already on the right screen
-# when pair-telegram prints the code. Silent best-effort — runs under a
-# spinner, any output (from `open` / `xdg-open`) goes to the raw log.
-if [ -n "$BOT_USERNAME" ]; then
-  case "$(uname -s)" in
-    Darwin)
-      open "tg://resolve?domain=${BOT_USERNAME}" >&2 2>/dev/null \
-        || open "https://t.me/${BOT_USERNAME}" >&2 2>/dev/null \
-        || true
-      ;;
-    Linux)
-      xdg-open "tg://resolve?domain=${BOT_USERNAME}" >&2 2>/dev/null \
-        || xdg-open "https://t.me/${BOT_USERNAME}" >&2 2>/dev/null \
-        || true
-      ;;
-  esac
-fi
+# Browser/app deep-link is done by the parent driver (setup/channels/telegram.ts)
+# BEFORE this script runs — gated on a clack confirm so focus-stealing doesn't
+# surprise the user. Keeping it out of here means this script stays pure
+# non-interactive install.
 
 log "Restarting service so the new adapter picks up the token…"
 case "$(uname -s)" in