First-run activation menu + bundled dbt sample project

[sahrizvi]

Problem

After the first-run auth + scan-gate flow, a user who dismisses the
scan or lands on an empty environment ends up staring at an
unqualified chat prompt. There's no guided next action, no way to try
Altimate without connecting a real warehouse, and no built-in demo
project to reason against.

What we want

1. Guided activation — after every branch of /onboard-connect, the
   agent emits a short JTBD menu (see downstream / review a SQL PR / try
   the sample project / describe your own). Warehouse-connected users
   get a personalized variant with cost-analysis.
2. Bundled sample dbt project — a shipped jaffle-shop DuckDB project
   the user can launch without any credentials. Idempotent materialize
   to the user's home, versioned marker so future CLI upgrades can
   detect stale copies.

Acceptance

• Scan-gate "No" leads to a menu, not an empty prompt.
• "Try the sample project" materializes a working dbt project offline.
• Sample-mode follow-up menu points at concrete jobs (dbt build,
  downstream impact, SQL review) that work against the sample.
• No credentials required until the user picks "Connect your own".