fix(tui): keep missing-model setup visible for startup prompts [skip ci]

Reuse onboarding_missing_key_recovery to keep the optional working-agreement checkpoint from covering the connection chooser for initial CLI input. Manual agreement setup, configured entry behavior and runtime permission gates remain.

Update the changelog with narrowly qualified Mac recovery, official filesystem MCP reconnect and published Code Review Native status/revocation evidence.

Verified: exact two-file diff, git diff --check and Rust syntax parsing. On source91fd, actual initial --prompt capture reproduced the obstructing checkpoint; typed draft/cancel, staged recovery/auth refusal, official MCP catalog/reconnect/revoke and published Native activation/status/revoke were observed separately. New guard runtime proof awaits the fresh stamped build; commit held locally until that passes.

CHANGELOG.md

@@ -64,13 +64,17 @@ until the matching tag, packages, checksums, and release assets exist.
   stores. Runtime loading restores a missing snapshot only from bytes matching
   its enabled review and policy; `codew plugins restage <name>` or
   `/plugin restage <name>` retries explicitly. Recovery preserves review and
-  generation and refuses an existing changed snapshot. Native and published
-  plugin qualification remains open for this source candidate.
+  generation and refuses an existing changed snapshot. Isolated macOS checks
+  exercised the published Code Review 1.0.8 Native status lifecycle and official
+  filesystem MCP reconnect; live review execution and other plugins remain
+  unqualified.
 - **Shared optional account sign-in:** `/connect` offers Codewhale sign-in or
   on-computer provider setup. Desktop and terminal use the same profile-scoped
   Rust account session; sign-in preserves the selected model and local keys.
   Ordinary logout removes the account session, while `logout --all` explicitly
-  clears saved model credentials. Real sign-in acceptance remains open.
+  clears saved model credentials. Startup prompts keep missing-model setup
+  visible instead of covering it with the optional working-agreement checkpoint.
+  Real sign-in acceptance remains open.
 - **Refresh model catalogs during use:** Runtime provider refresh now checks
   public Models.dev metadata alongside the exact provider's model list;
   `force_catalog=true` bypasses the public cache TTL and retry backoff.

crates/tui/src/tui/ui/event_loop.rs

@@ -1147,7 +1147,10 @@ pub async fn run_tui(
     }
     surface_prompt_override_notices(&mut app);
 
-    if options.resume_session_id.is_none() && !app.launch.visible {
+    if options.resume_session_id.is_none()
+        && !app.launch.visible
+        && !app.onboarding_missing_key_recovery
+    {
         // The one-time Fleet intro is no longer a launch push: it appears the
         // first time the user opens `/fleet` or enters Operate (apply.rs).
         let _ = open_setup_checkpoint_if_due(&mut app, config, options.skip_onboarding);