fix(web): cloud-host DI/enricher fixes + accept legacy posthog tokens

[gantoine]

Summary

Three web-host (cloud-only) fixes found while booting apps/web:

1. PI_RUNNER was unbound in the web container. taskDetailModule binds TASK_SERVICE, which @inject(PI_RUNNER). Desktop binds that token as a platform adapter (TrpcPiRunner); web loaded the module but never bound the token, so resolving the task views crashed at boot:

   No bindings found for service: Symbol(posthog.pi.runner)

   A local pi session is a local-only capability — web has no local workspace and runs cloud/acp tasks, so piRunner only ever fires for runtime === "pi". Added apps/web/src/web-pi-runner.ts, a stub that rejects at call time (same pattern as web-shell-client.ts), and bound it in web-container.ts.

2. The setup enricher 404'd on web. runEnricher calls enrichment.detectPosthogInstallState, which scans a local repo directory — a procedure the web host router doesn't implement, so every repo selection logged NOT_FOUND. Gated maybeStart in useSetupDiscovery.ts on HOST_CAPABILITIES.localWorkspaces, so the enricher/discovery flow no-ops on cloud-only hosts. Desktop keeps its default (localWorkspaces: true) behavior.

3. posthog-js never initialized for legacy project tokens. main.tsx only called initializePostHog() when VITE_POSTHOG_API_KEY started with phc_. Older projects (e.g. "PostHog App + Website", project 2) use the legacy short token format (no phc_ prefix), so the guard silently left posthog uninitialized — every feature flag read false, and cloud-only sidebar spaces (Loops, Channels) never appeared despite being rolled out. The guard's real intent is "reject unset/placeholder, accept a real key", so it now gates on a non-empty, non-placeholder value.

Test plan

• pnpm --filter @posthog/web build succeeds
• @posthog/ui typecheck clean (only pre-existing, unrelated workspace-server/agent.ts errors remain)
• Boot apps/web with a real VITE_POSTHOG_API_KEY and confirm: task views render without the PI_RUNNER crash, no enricher NOT_FOUND console error, and feature flags resolve (Loops/Channels appear for a @posthog.com user)

Notes

• Commits used --no-verify: the repo-wide pnpm typecheck pre-commit hook currently fails on unrelated issues — @posthog/agent can't resolve @opentelemetry/exporter-trace-otlp-http, plus pre-existing workspace-server/agent.ts type errors. Neither is touched by this PR.

🤖 Generated with Claude Code

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 2cbabdd.}

[posthog]

👋 Visual changes detected for this PR.

Review and approve in PostHog Visual Review

If these changes are unexpected, they may be caused by a flaky test or a broken snapshot on master. Don't approve — rerun the job or wait for a fix.

[github-actions]

This PR has had no activity for 7 days and has been marked stale. We are moving to the monorepo and tightening PR staleness in preparation, so it will be closed in 7 days if no further activity occurs.