tui/firstrun: fresh-state detection (no provider record + no checkpoint
= first boot); stage machine (welcome -> provider catalog -> model list
-> connection test -> done) through lib.ModelLister (off-thread, pending/
answer protocol); no-default gate (chat refused until explicit selection
recorded in provider_selection.json, atomic write); scrubbed record
re-gates (leaving configured state re-triggers first-run). 7/7 frozen
red-first green. Main-session verify: green own run. Face wiring deferred
(main.go owned by chat-live wave).
