fix(checks): enforce onboarding entry composition coverage (#9190)

<!-- markdownlint-disable MD041 -->
## Summary

Close static TypeScript coverage gaps in the onboarding
entry-composition ratchet after #9178. The check now records existing
lifecycle decisions that the prior scan missed and fails closed when new
decisions exceed the merge-base ceiling.

## Related Issue

Advances #9172.

## Changes

- Scan declaration headers, callable scopes, initializers, module
statements, and nested callable bodies.
- Normalize the static lifecycle and recovery call forms covered by the
regression matrix.
- Record existing gateway, messaging, policy, and provider decisions.
The work in #9169, #9170, and #9172 will remove these allowances.
- Reject budget increases above the decisions present at the merge base.
- Add regression tests for the decision and recovery syntax that the
check detects.

## Type of Change

- [x] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [ ] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [x] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [ ] Tests not applicable — justification:
- [ ] Docs updated for user-facing behavior changes
- [x] Docs not applicable — justification: This change affects an
internal repository check only.
- [x] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [x] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification: Independent Codex
Desktop review passed all nine security categories for commit under
review `9072818a6220c97bcd02a2b20b0a34915902df6d`. The PR-owned files
are unchanged by the additive merge of
`a8ceeb1a6e5ca4e517a4bc0c9767f8a7cc52916d`. That merge adds Google
Gemini docs and provider-catalog tests outside this check. The review
confirmed fixed-argument Git execution, fail-closed merge-base errors,
lexical alias isolation, and positive and negative tests.
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `no-docs-needed`
- Evidence: The PR changes an internal repository check, its allowance
data, and tests. The additive merge of
`a8ceeb1a6e5ca4e517a4bc0c9767f8a7cc52916d` changes only Google Gemini
docs and provider-catalog tests. The merge does not alter the three
PR-owned blobs or their reviewed behavior. This change does not alter
runtime, CLI, API, configuration, defaults, policy schema, or supported
product behavior. The prior focused tests passed 179/179. I did not
rerun them because the PR-owned blobs are unchanged.
- Agent: Codex Desktop
<!-- docs-review-head-sha: 9072818 -->
<!-- docs-review-agents-blob-sha: e30afb2 -->

## DGX Station Hardware Evidence

- [ ] Tested on DGX Station
- Tested commit:
- Station profile/scenario:
- Result:
- Supporting evidence:

## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — command/result or justification: `npx
vitest run test/onboard-entry-composition.test.ts
test/checks-runner.test.ts` passed, 179/179 tests.
- [ ] Applicable broad gate passed — `npm run check` was attempted.
Host-specific failures include an unsafe writable parent, a foreign user
gateway service, overlong Unix socket paths, and missing plugin-local
`json5`. GitHub CI provides the clean broad result.
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [ ] `npm run docs` builds without warnings (doc changes only)
- [ ] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Carlos Villela <cvillela@nvidia.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved detection of gateway and onboarding decisions across complex
code patterns, including callbacks, nested calls, recovery actions, and
lifecycle logic.
* Added safeguards to prevent composition budgets from expanding beyond
approved limits.
* Improved validation and reporting when comparison baselines cannot be
determined.

* **Tests**
* Expanded coverage for decision detection, budget enforcement,
duplicate allowances, and category or declaration changes.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Signed-off-by: Carlos Villela <cvillela@nvidia.com>
Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com>
Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com>

Author: cv

ci/onboard-entry-composition-budget.json

@@ -1,20 +1,35 @@
 {
-  "$comment": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.\nSPDX-License-Identifier: Apache-2.0\nProvider decisions remain until #9169. Messaging decisions remain until #9170. Policy decisions remain until #9172. The budget permits no gateway decisions.",
-  "gateway": {},
+  "$comment": "SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.\nSPDX-License-Identifier: Apache-2.0\nProvider decisions remain until #9169. Messaging decisions remain until #9170. Gateway and policy decisions remain until #9172.",
+  "gateway": {
+    "preflight": 2,
+    "preflightAuthoritativeRebuildTarget": 1,
+    "runOnboard": 2
+  },
   "messaging": {
     "createSandboxWithBaseImageResolution": 9,
-    "runOnboard": 1
+    "createSandboxWithBaseImageResolution.plan.rebindMessagingTokenDefs": 1,
+    "getOpenShellInstallDeps.hasRequiredOpenshellMessagingFeatures": 4,
+    "runOnboard": 1,
+    "runOnboard.finalizationDeps.verifyDeployment.getMessagingChannels": 1
   },
   "policy": {
-    "createSandboxWithBaseImageResolution": 6,
-    "runOnboard": 5
+    "createOnboardPolicyApplication.getRecordedPolicyTier": 1,
+    "createSandboxWithBaseImageResolution": 7,
+    "preflightAuthoritativeRebuildTarget": 1,
+    "runOnboard": 6,
+    "sandboxCreateIntentResolver.getAgentPolicyPath": 1
   },
   "provider": {
-    "createSandboxWithBaseImageResolution": 15,
-    "handleNimLocalSelection": 32,
-    "handleRemoteProviderSelection": 76,
-    "handleRoutedSelection": 15,
+    "createSandboxWithBaseImageResolution": 20,
+    "handleNimLocalSelection": 36,
+    "handleRemoteProviderSelection": 84,
+    "handleRemoteProviderSelection.providerExistsInGateway": 1,
+    "handleRemoteProviderSelection.readGatewayProviderMetadata": 1,
+    "handleRoutedSelection": 16,
+    "handleVllmSelection.queryVllmModels": 1,
+    "preflightAuthoritativeRebuildTarget": 1,
     "runOnboard": 8,
-    "selectAndValidateOllamaModel": 18
+    "runOnboard.providerInference.deps.needsBedrockRuntimeAdapter": 1,
+    "selectAndValidateOllamaModel": 19
   }
 }