refactor(orchestrate): extract 4 helpers from 345-line postInstall

[la14-1]

Why: postInstall() in orchestrate.ts is 345 lines handling 7+ distinct responsibilities — the longest function in the codebase. Navigating or testing any single subsystem requires reading through the entire monolith.

Changes

Extract 4 focused helpers from postInstall():

1. installSkillEnvVars(runner) — skill env var base64 encoding + injection into .spawnrc
2. setupDashboardTunnel(cloud, tunnelCfg, spawnId) — SSH tunnel start, signed preview URL, local browser open, metadata save
3. setupTelegramPairing(runner) — Telegram pairing code prompt + openclaw pairing call
4. runInteractiveSession(cloud, launchCmd, spawnId, tunnelHandle) — terminal reset, reconnect loop, exit code handling, child history pull

Reduces postInstall from 345 to ~200 lines. Pure refactor — no behavior change.

Test plan

• bunx @biomejs/biome check src/ — 0 errors
• bun test — 2106 pass, 2 pre-existing flaky failures (fetch mock pollution, tracked in fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341)
• Verified failing tests pass in isolation

-- refactor/complexity-hunter

[la14-1]

CI status: Mock Tests job shows 4 failures, but none are introduced by this PR:

• doApi 401 OAuth recovery and hetzner/createServer — pre-existing fetch mock pollution, fixed by fix(tests): use URL-aware fetch mocks to fix concurrent test pollution #3341
• cmdRun happy-path pipeline (x2) — flaky in coverage mode only, also pre-existing (same failures seen on main branch runs)

Local bun test in this branch: 2106 pass, 2 fail (same 2 pre-existing failures as main).

Once #3341 merges and this branch rebases, all 4 CI failures should resolve. Draft status is appropriate until then.

-- refactor/pr-maintainer

[la14-1]

Rebased onto main to resolve merge conflicts (package.json version bump).

-- refactor/pr-maintainer

[la14-1]

Fixed CI: removed duplicate "version" key in packages/cli/package.json that was introduced during the rebase. bun install was failing with Duplicate key "version" in object literal. CI should pass now.

-- refactor/pr-maintainer

[la14-1]

This PR has been open for 3+ days with all CI checks passing (ShellCheck, Mock Tests, Biome Lint, Unit Tests, macOS Compatibility — all SUCCESS). It is mergeable with no conflicts.

Requesting human review when convenient.

-- refactor/pr-maintainer

[la14-1]

Rebased onto main (dropped the now-redundant duplicate-version-key fix commit). Branch is clean with 1 commit. Awaiting human review.

-- refactor/pr-maintainer

[la14-1]

This PR is ready for review. All CI checks pass and there are no merge conflicts.

-- refactor/pr-maintainer

[la14-1]

Rebased onto main (was 4 commits behind). Clean rebase, no conflicts.

-- refactor/pr-maintainer

[la14-1]

Verified in worktree: tests pass (2236/2238, same 2 pre-existing failures as main), lint clean (biome 0 errors). PR is mergeable and ready for review.

-- refactor/pr-maintainer