Create .github/onboarding/ kit: per-stack profiles, versions.json, protection preset, contract check

[s-hiraoku]

Background

Design: onboarding-kit-design-2026-07-05.ja.md (§6.1, §6.3, §6.4, §6.6, §9 Stage 1 item 1) — pending merge via #111.

Generalizes the dogfood-sync target pattern (declarative preset + deterministic contract check + script tests) into an onboarding kit for external target repositories.

Task

Create the onboarding/ directory:

1. profiles/: pilot-node.yml, pilot-python.yml, pilot-go.yml, pilot-rust.yml, standard.yml — partial overlays on the default .kaizen/config.yml. Pilot profiles: safety.wipLimit: 2, policy.mode: pr-only, directCommit: 0/0, run.maxIssuesPerNight: 1, protected-paths floor included.
2. versions.json: compatible version set for kaizen-loop / builder-agent / verifier (blocked on release tags, see the tagging issue).
3. scripts/apply-branch-protection.sh: idempotent gh api PUT applying the org-standard protection (required check + required_conversation_resolution: true + enforce_admins; policy doc: Document generated-PR conversation-resolution policy in design-decisions.md (closes playbook A-2) #106). Takes the required check name as an argument. Not invoked from kaizen init — admin-privileged step kept separate.
4. scripts/check-onboarding-contract.sh: deterministic verification of the Onboarding Contract — schema-valid config, safety floor (pr-only, wipLimit <= 5, verifier.enabled, protected-paths superset, **/.git/** forbidden), labels, issue template, branch protection, smoke artifact present.
5. scripts/install-kaizen.sh: installs the three components per versions.json (npm install -g github:kaizen-agents-org/<repo>#<tag>).
6. Test scripts for 3–5 following the existing test-sync-*.sh pattern, wired into CI-equivalent checks.
7. README.md: profile selection guide.

Done when

A target repo can be validated end-to-end by check-onboarding-contract.sh, and the profile safety floor cannot be removed by an overlay (covered by a test).

[s-hiraoku]

Scope update from the extended design (PR #111, commit ee67da1):

• onboard.sh (new, the main deliverable): idempotent orchestrator run inside the target repo — toolchain install/update → profile proposal → kaizen init --profile → branch protection → doctor --repair → smoke --yes → contract check. Exactly 3 human confirmation points (verify commands / protection / smoke); --yes --profile <name> for non-interactive. Re-running it is the update mechanism (design §7/§7.1).
• onboarding/automations/scout.prompt.template.md + enable-scout.sh: parameterized scout prompt (repo/labels/WIP caps), opt-in only, enablement gated on existing weekly metrics (design §6.9a).
• onboarding/fleet.json: registry the org-side monitor/weekly-readiness automations iterate over; adding a target repo = one-line PR (design §6.9b).
• Contract check addition: verify vendored skills/ matches skills-manifest.json and the installed toolchain's bundled versions (design §6.8).