feat: zero-setup onboarding (wallet login provisions everything)

[JamesLawton]

Summary

polygon-agent wallet login is now the entire onboarding. No keys to obtain, no setup step.

• The CLI ships a default OMS publishable key (client-embeddable by design; the intended production project key). Resolution order: SEQUENCE_PUBLISHABLE_KEY env, then builder.json, then the baked default. setup --oms-publishable-key stays as the advanced override.
• After a successful login, the CLI auto-provisions a Sequence Builder project and access key (the ephemeral-EOA ETHAuth flow setup always used, relocated to run automatically) and saves it to builder.json. That key carries the per-user indexer and Trails quota.
• Provisioning never fails a login: failures print a stderr note, surface as builderProvisioned: false in the login JSON, and retry on the next login. Existing users with a populated builder.json are untouched.
• saveBuilderConfig now merges instead of overwriting, fixing a review-caught critical where provisioning (or setup --force) could silently wipe publishableKey or a stored Polymarket private key.
• Also considered: signing the Builder ETHAuth proof with the embedded smart wallet (would bind projects to user identity and allow cross-machine recovery). Blocked today by the OMS SDK's typed-data signing; documented in the spec as a follow-up.

Spec: docs/superpowers/specs/2026-07-14-zero-setup-onboarding-design.md. 21 CLI tests (8 new), full per-task and whole-branch reviews; all findings fixed in-branch.

Verification still open

The live clean-profile e2e (fresh HOME, real browser login, then balances + deposit dry-run with zero env vars) needs a human sign-in and is being run alongside this PR; everything code-verifiable (clean-HOME smoke: default key constructs the client and prints the sign-in URL with no config present) already passed.

Before production release (rolls up with PR #122's checklist)

• The relay custom domain, Sequence allowlist, and CLI URL-default flips from PR feat: browser login via agentconnect (Google or email on the login page) #122.
• Only then publish to npm.

Follow-ups (intentionally not here)

• Timeouts (AbortSignal.timeout) on the Builder API fetches
• Wallet-signed Builder auth for cross-machine project recovery (pending SDK support)
• First command-layer integration test (handleLogin wiring)
• alreadyLoggedIn short-circuit JSON omits builderProvisioned (shape varies by path; document or unify)

🤖 Generated with Claude Code

[claude]

Code review

1 issue found. Checked for bugs and CLAUDE.md compliance.

Bug in packages/polygon-agent-cli/src/commands/wallet.ts (lines 94-101): Provisioning never retries on subsequent logins

The comment on line 153 says "provisioning retries on the next login" and the stderr message on line 159 tells users "it will retry on the next login." However, when a user runs wallet login again after a failed provisioning, the already-logged-in short-circuit on line 94 returns immediately because oms.wallet.walletAddress is already set -- ensureBuilderAccessKey on line 154 is never reached.

Provisioning only retries if the user passes --force (full re-auth) or waits for session expiry (~1 week). This contradicts the documented behavior.

Suggested fix: Check for an existing Builder access key in the short-circuit path and call ensureBuilderAccessKey if missing. Before the early return, add a check like if (!loadBuilderConfigRaw()?.accessKey) and run provisioning in that case.