workspace onboarding: emit a prioritized, executable action sequence alongside the status inventory

[codeforester]

Problem

basectl workspace onboarding currently reports what is missing — repos not cloned, projects not set up, health issues found. But it does not tell the user what to do first or in what order. A new teammate or returning contributor faces a wall of status output rather than a guided path to a ready workspace.

The current output is a diagnostic inventory. What users actually need is a prescription: "run these commands, in this order, and you will reach a ready workspace."

Proposed solution

Add a "next actions" section to workspace onboarding output that:

1. Determines the correct ordered remediation sequence based on what's missing (clone missing repos → run basectl setup for each unconfigured project → run basectl trust for new manifests → run basectl check to verify).
2. Emits those steps as a human-readable numbered list with copyable shell commands.
3. Exposes the same steps in --format json as a next_actions array, consumable by workspace agent-brief or onboarding automation.

Example human-readable output

Workspace onboarding — next actions (3 steps to ready):

  1. Clone missing repos:
       basectl workspace pull

  2. Set up unconfigured projects:
       basectl setup api-service
       basectl setup auth-service

  3. Verify workspace health:
       basectl workspace check

Example JSON (next_actions field)

{
  "next_actions": [
    { "order": 1, "description": "Clone missing repos", "commands": ["basectl workspace pull"] },
    { "order": 2, "description": "Set up unconfigured projects", "commands": ["basectl setup api-service", "basectl setup auth-service"] },
    { "order": 3, "description": "Verify workspace health", "commands": ["basectl workspace check"] }
  ]
}

Acceptance criteria

• workspace onboarding human output includes a "next actions" section with ordered, executable shell commands.
• The sequence is deterministic and correct: clone before setup, setup before trust/verify.
• workspace onboarding --format json includes a next_actions array with order, description, and commands fields.
• A fully-ready workspace produces an empty next_actions array.
• workspace agent-brief incorporates next_actions (or an equivalent derived field) for agent consumers.
• Help text updated to describe the next-actions output.
• Tests covering: fully ready (empty actions), one missing repo, multiple unconfigured projects.