Harden first-run UX and product truth

[AetherAI3]

Summary

• make first-run help, auth status, browser fallback, live model selection, and unsupported-Node failures concise and actionable
• remove experimental --swarm from normal help/generated docs while preserving its explicit runtime refusal; keep SC-DEVICE hidden/default-off
• harden POSIX and PowerShell installer permission/PATH guidance and print only real hosted/local next steps
• modernize CONTRIBUTING.md and add first-run, installer, auth, catalogue, generated-doc, and failure-message regression coverage

Required-base and lease evidence

• head: 18e6fee
• sole parent: e9cbe44
• no README, catalogue snapshot, release/version, Cloud, APR, Supercluster, ATS Web, asset, or community-template edits
• no runtime dependency added

Verification

• npm ci --ignore-scripts: pass in isolated worktree
• build / typecheck / lint: pass
• focused lane suite: 97 pass, 0 fail, 3 POSIX-only skips on Windows
• sh -n and bash -n install.sh: pass with Git for Windows
• PowerShell parser: pass; parser probes are bounded
• npm run docs:check: pass (6 outputs)
• npm run verify:production: pass; exact tarball installed/launched from a clean temporary prefix (673 files, 4,455,491 bytes)
• npm run release:truth: pass (12/12, 0 unavailable)
• npm pack --dry-run: pass (673 files, 1.4 MB package)
• live auth status and aether models: pass; runtime catalogue is authoritative
• hosted smoke task: pass and returned pong
• fast doctor: pass, 0 errors

Transparent host-only gaps

• full npm test: 1,858 pass, 6 fail, 7 skip. All six are timeout/process-cleanup checks in byte-unchanged files from the required base; isolated rerun cleared four, while one Job Object timeout and one one-shot timing threshold remained slow on this loaded Windows host.
• npm run smoke: hosted/auth/web surfaces pass, web search skips, local turn fails because the installed Ollama daemon lists qwen2.5-coder:7b but drops inference requests.
• live doctor preserves zero spend and no orphans, but Cloud currently rejects doctor dev sessions with 403; one catalogue probe also timed out. The unpublished-branch warning should clear after this push.
• WSL is installed but its service is disabled; macOS was not locally available. POSIX syntax and behavior remain covered by hosted Linux CI.

Exact-head hosted CI is required before merge. Do not merge from this lane.

[AetherAI3]

AGENT03-H02 exact-head handoff

Head 18e6fee is unchanged and has required parent e9cbe44.

Exact-head hosted checks are all green:

• Test (ubuntu-latest): pass
• Test (windows-latest): pass
• supply-chain: pass
• CodeQL: pass
• analyze: pass
• Aether Hosted Build & Test: pass

Local deterministic gates also pass: build, typecheck, lint, 97 focused tests, docs:check, verify:production exact-tarball install, release:truth 12/12, npm pack --dry-run, sh/bash syntax, and PowerShell parser.

Remaining environmental evidence is already documented in the PR body: this host's Ollama daemon lists the canonical model but drops inference; live doctor is zero-spend/no-orphan but Cloud doctor sessions are rollout-disabled (403) and one catalogue probe timed out. WSL service and macOS were unavailable locally. Hosted Windows/Linux results are authoritative for this exact head.

No merge, version bump, tag, publish, or out-of-lease file change was performed. Ready for Merge Masters review.