Issue 1: Shared bootstrap extraction + variant gating

[gewenyu99]

Issue 1: Shared bootstrap extraction + variant gating

Epic: Task-queue orchestrator runner · Depends on: none (first) · PR: #606

Why

The orchestrator arm reuses the linear runner's setup: health check, settings
conflicts, OAuth and credentials, MCP url, variant metadata. It branches cleanly
so the linear baseline is untouched when the flag is off. Gating is the boolean
wizard-orchestrator feature flag, evaluated like any other wizard flag.

Scope / deliverable

1. Extract bootstrapProgram(session, config, programConfig) → BootstrapResult
   from runProgram steps 1 to 4, plus the mcpUrl, wizardFlags, and
   wizardMetadata computation (agent-runner.ts:183–312). It returns
   { skillsBaseUrl, projectApiKey, host, accessToken, projectId, cloudRegion, mcpUrl, wizardFlags, wizardMetadata }. Both arms call it.
2. Add isOrchestratorEnabled(flags), mirroring buildWizardMetadata
   (agent-interface.ts:357). It returns true when flags['wizard-orchestrator'] === 'true'. The flags come from getAllFlagsForWizard()
   (analytics.ts:143), already evaluated in the run. To test in the dark, enable the wizard-orchestrator flag for your own user in PostHog.
3. Add the fork at agent-runner.ts:302, after OAuth and before agent init:

   const boot = await bootstrapProgram(session, config, programConfig);
   if (isOrchestratorEnabled(boot.wizardFlags))
     return runOrchestrator(session, programConfig, boot);
   // the linear steps 5 to 12 continue here

   Skill install (step 5, :285–300) runs on the linear arm.
4. Add orchestrator: { VARIANT: 'orchestrator' } to WIZARD_VARIANTS
   (constants.ts:147) so the variant header and telemetry tag flow automatically.
5. Extract mapAgentError(agentResult, config) → WizardError | null from the
   error-handling block (agent-runner.ts:391–482) so each executor task
   classifies failures the same way: ABORT, MCP_MISSING, API_ERROR, YARA. The
   terminal wizardAbort and outro behavior stays in the linear arm. The executor
   consumes the classification.
6. Provide a stub runOrchestrator that logs and returns, so the fork is
   exercisable before the real executor lands.

Key files

• src/lib/agent/agent-runner.ts (bootstrap extraction, fork, error-map extract)
• src/lib/constants.ts (WIZARD_VARIANTS)
• new src/lib/agent/bootstrap.ts, or keep bootstrapProgram in agent-runner
• new src/lib/programs/orchestrator/orchestrator-runner.ts (stub runOrchestrator)

Acceptance criteria

• The linear path is preserved. Existing unit and e2e suites are green with
  the flag off.
• With the wizard-orchestrator flag enabled, runProgram calls the
  stub runOrchestrator right after OAuth and skips the linear steps 5 to 12.
• VARIANT: orchestrator is present in the agent env when the flag is
  orchestrator, and only then.
• bootstrapProgram and mapAgentError are unit-testable, and both arms call
  bootstrapProgram with identical results.

[gewenyu99]

Superseded by #688 (refactor/agent-runner-split), which is the clean realized form of this extraction: runner/shared/bootstrap.ts + runner/shared/types.ts (BootstrapResult / ProgramRun) and the mode dispatch in runner/index.ts. Done via #688.