Extract onboarding gateway lifecycle application

@cv

Important

Reserved for @cv. Do not self-assign this issue. Do not open an implementation PR unless @cv requests help.

Parent: #7695

Problem

src/lib/onboard.ts owns OpenShell gateway create, start, stop, and recovery decisions.

Move gateway lifecycle behavior into src/lib/onboard/gateway/.
Keep the onboarding entry module responsible for phase sequencing and dependency wiring.
Reduce the onboarding fan-out and root-file budgets.

The gateway phase has a named input and result contract.
The onboarding entry module contains no gateway lifecycle decision.
Resume and failure behavior remain unchanged.
Gateway and onboarding tests pass.
Architecture checks prevent new gateway lifecycle decisions in the entry module.