refactor(setup): group steps into four phases ordered by failure probability

[DavidMiserak]

Closes #1902.

This is the "(3) phase reorder last, against fresh main, with an issue
describing the failure modes it fixes" split @jbetala7 asked for on #1883.

What this PR is

A behavior-preserving reorganization of setup into four phases
bracketed by header comments. See #1902 for the failure modes that
motivate it.

Phase	What runs	Fail risk
A	Filesystem: ~/.gstack/, welcome, GBrain detection (scan)	Always succeeds
B	Local compute: bun build, skill linking, migrations, GBrain regen	Low
C	settings.json mutation: team + plan-tune hooks	Medium, reversible
D	External network / sudo / package managers: coreutils, font, Playwright	Highest

Each phase header is a comment block in the script. Steps inside are
renumbered (A1, A2, A3, B1, B2a, ...).

What this PR is NOT

To keep this reviewable as a structural move, the two behavior changes
that were originally bundled with the reorder on #1883 are not here:

• fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898 — bun_cmd routing in three link_*_skill_dirs helpers +
  removing | tail -3 from gen:skill-docs:user. Already opened.
• fix(setup): Playwright Chromium failure becomes best-effort warn, not exit 1 #1900 — Playwright exit 1 → _PW_FAIL_REASON best-effort warn.
  Coordinates with fix(setup): pin Playwright browser install to bundled version so headed browse connect works (#1829) #1838.

In this PR's diff:

• The three bun_cmd call sites are still bun run (the bug — fixed in fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898).
• The gen:skill-docs:user invocation in B6 still pipes through tail -3
  (the bug — fixed in fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898).
• Phase D3 (Playwright) still has the two exit 1 paths from origin/main
  (the design issue setup: Playwright Chromium download failure aborts setup before skills/hooks/migrations land #1902 names — fixed in fix(setup): Playwright Chromium failure becomes best-effort warn, not exit 1 #1900).

This is intentional. A reviewer can read this diff as "did anything
besides moving lines around and splitting one block?" The answer should
be: just the GBrain detect/regen split (entailed by the new order) and
one safety guard for that split (see next section).

The one behavior change this PR DOES contain

The phase reorder requires splitting GBrain detection from GBrain regen:

• A3 runs detection (a filesystem scan via gstack-gbrain-detect,
  no dependencies). Writes the result to ~/.gstack/gbrain-detection.json.
• B6 reads that file and decides whether to regenerate Claude
  SKILL.md with brain-aware blocks (after the binary is built + skill
  docs are generated).

This split is necessary because A runs before bun is prepared, so the
regen call (which needs bun) can't live in A. Splitting introduces one
new failure mode: what happens if detection fails in A3 but a stale
gbrain-detection.json from a prior successful run still exists?
Without a guard, the stale "ok" file would survive a failed detect and
silently trigger brain-aware regen in B6 — applying ~250 tokens of
overhead per planning skill to a user whose gbrain may have been
removed.

The guard: A3 removes both the temp file AND any pre-existing
gbrain-detection.json when gstack-gbrain-detect exits non-zero.

if "\$DETECT_BIN" > "\$DETECTION_FILE.tmp" 2>/dev/null; then
  mv "\$DETECTION_FILE.tmp" "\$DETECTION_FILE"
else
  rm -f "\$DETECTION_FILE.tmp" "\$DETECTION_FILE"    # <-- the guard
  log "  warning: gstack-gbrain-detect failed — brain-aware blocks will stay suppressed"
fi

test/setup-gbrain-detection.test.ts pins this with a static-source
check so a future refactor that drops the guard fails CI.

Tests

$ bun test test/setup-*.test.ts
 66 pass / 0 fail / 152 expect() calls

All 7 existing setup test files still green on the reordered structure.

Test plan

• bun test test/setup-*.test.ts — 66 pass
• bash -n setup — syntax OK
• Manually traced each phase's step ordering matches the dependency
  graph (A doesn't depend on anything in B/C/D; B doesn't depend on
  C/D; C doesn't depend on D)
• Verified that no bug fix from fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898 or fix(setup): Playwright Chromium failure becomes best-effort warn, not exit 1 #1900 leaked into this diff
  via grep (bun_cmd run gen:skill-docs --host {codex,factory,opencode}
  = 0 in link helpers; | tail -3 still present in B6;
  _PW_FAIL_REASON = 0; Playwright exit 1 = 2)

Relationship to #1883

This PR is the third and final split from #1883. Once this is open,
#1883 stays as the parking lot only long enough to add the three split
links and a close note.

Sibling PRs:

• fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898 — bug fixes (independent, can land any time)
• fix(setup): Playwright Chromium failure becomes best-effort warn, not exit 1 #1900 — Playwright warn (coordinated with fix(setup): pin Playwright browser install to bundled version so headed browse connect works (#1829) #1838)

Recommended merge order

1. fix(setup): route gen:skill-docs through bun_cmd; drop tail -3 pipe that masks bun failures #1898 first (tiny, independent).
2. fix(setup): pin Playwright browser install to bundled version so headed browse connect works (#1829) #1838 + fix(setup): Playwright Chromium failure becomes best-effort warn, not exit 1 #1900 together (both touch the Playwright block;
   either can land first then the other rebases).
3. This PR last, rebased after the above land so the diff stays
   small and reviewable.

If preferred, this PR can land before #1898 / #1900 — they're against
fresh main with no overlap, but rebasing them on top of this would make
their diffs harder to read because they'd be against the reordered
structure. The chosen order (this PR last) keeps each diff minimal
against the structure its reviewer already knows.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here