skill(slice-21 FR-2): add first-user workspace setup teaching section to openrig-user boot skill (OPR.0.3.2.21.FR-2)

Closes the slice-21 §1 dogfood gap "no obvious way to instantiate
workspace or workflow on a host with prior projects". The shipped
CLI surface lands in slice-01; this slice teaches the surface at
the boot-skill layer so a freshly-booted agent knows to reach for
the canonical commands rather than improvising.

Per FR-2 IMPL-PRD option (a) recommendation + the FR-1 precedent
of co-locating boot-instinct content in the openrig-user skill,
the new section is added inline rather than as a sibling skill.

Placement: between the existing "Runtime-Gated Coordination
Primitives" section (which discusses runtime-gating of the daemon
coordination surfaces) and the existing "v0.3.x Starter, Workspace,
And Plugin Surfaces" section (which is version-timestamping, not
teaching). Reader flow becomes: coordination model (HOW to
coordinate, FR-1) → runtime-gating context → first-user workspace
setup (WHERE work lives + how to set up, FR-2) → version surfaces
→ core loop → rest. The two FR-1 + FR-2 content sections together
land in the first ~30% of the file.

Section content (5 topics per IMPL-PRD scope spec):

(1) Detect workspace state at boot — rig workspace validate [path]
    --kind <user|project|knowledge|lab|delivery> --json. Walks the
    root + emits a structured frontmatter-gap report. Non-zero
    exit on gaps. When gapCount > 0 or workspace is
    unset/unwritable, the next section's instantiation is needed.

(2) Instantiate the canonical workspace scaffold — rig config
    init-workspace [--root <path>] [--force] [--dry-run] [--json].
    Scaffolds missions/, progress/, field-notes/, specs/,
    dogfood-evidence/ under workspace.root (default
    ~/.openrig/workspace). Idempotent. Seeds two example missions +
    workspace README.md + STEERING.md. --force overwrites files
    but never deletes dirs.

(3) Redirect the workspace root — OPENRIG_WORKSPACE_ROOT=<path>
    for one-shot or rig config set workspace.root <path> for
    persistent. ConfigStore precedence env > config-file > default
    named explicitly + parallel for OPENRIG_WORKSPACE_SPECS_ROOT →
    workspace.specs_root (default <workspace_root>/specs).

(4) Build a workspace from scratch — same rig config
    init-workspace --root /path/to/new/workspace surface; the
    workspace.root cascade handles non-existent paths.

(5) Create a workflow inside an existing workspace — workflow
    spec files live at <workspace_root>/specs/workflows/<name>.yaml
    (verified against startup.ts:914 workflowsFolderDir
    construction). Authoring is direct YAML; there is no rig
    workflow create verb in v0.3.x. Validation + instantiation are
    agent-actionable via rig workflow validate / instantiate.
    Inspection via rig workflow specs / list / show.

Operator-vs-agent boundary per HG-4: each sub-section opens with
"Agent-actionable" / "Operator-gated when persistent" so the
boundary is explicit.

Verify-don't-relay against shipped surface (banked RTFM-before-design):

The IMPL-PRD's command-name claims required correction against
LOCAL main f8b8dbe5 shipped reality:

- IMPL-PRD §58 referenced "rig workspace init <path>" — does NOT
  exist. Actual instantiation lives at rig config init-workspace
  (config-init-workspace.ts), not rig workspace.
- IMPL-PRD §64 referenced "rig workflow create" — does NOT exist.
  Workflow YAML is authored directly; the v0.3.x rig workflow
  surface only ships validate / instantiate / list / specs / show /
  trace / continue / project verbs (workflow.ts).
- IMPL-PRD §60 referenced "--workspace-root <path>" flag — does
  NOT exist. rig config init-workspace ships --root <path>; env-var
  redirect is OPENRIG_WORKSPACE_ROOT.

The section authors against the actual shipped surface; the PRD
command-name divergence is called out in the per-commit handoff
body so guard can confirm the fidelity end-state without re-doing
the RTFM pass.

Acceptance per FR-2 IMPL-PRD (HG-1 through HG-8):
- HG-1: all 5 numbered topics covered. CONFIRMED.
- HG-2: exact slice-01-shipped CLI command names + flags (verified, not invented). CONFIRMED — workspace.ts + config-init-workspace.ts + workflow.ts + config.ts + config-store.ts read directly.
- HG-3: env-var redirect mechanism named correctly with ConfigStore precedence. CONFIRMED.
- HG-4: operator-vs-agent boundary explicit per step. CONFIRMED.
- HG-5: workflow spec file location named with workspace-root context. CONFIRMED — <workspace_root>/specs/workflows/<name>.yaml.
- HG-6: harmonized with FR-1 (coordination section untouched; v0.3.x version-timestamping section untouched; placement is between the two existing sections without disturbing either). CONFIRMED.
- HG-7: skill renders cleanly (94 code fences = balanced even); frontmatter unchanged at lines 1-4. CONFIRMED.
- HG-8: adversarial dogfood deferred to velocity-qa per slice gate sequence.

Branch: slice-21-fr-2-first-user-workspace-setup-teaching off LOCAL
main f8b8dbe5. LOCAL only, NO push.

packages/daemon/specs/agents/shared/skills/core/openrig-user/SKILL.md

@@ -137,6 +137,128 @@ Default posture:
 - Do not perform daemon stop/start, production DB copy/mutation, release, publish, or other
   consequence-boundary actions unless the operator/workstream has granted that specific gate.
 
+## First-user workspace setup
+
+When booting into a rig on a host where the workspace is unset, gap-ridden, or
+points at a stale layout, address that before substantive project work. The
+shipped surface is small + bounded — reach for the canonical commands rather
+than improvising.
+
+### Detect workspace state at boot
+
+Agent-actionable when the daemon is reachable.
+
+```bash
+rig workspace validate --json
+rig workspace validate <path> --kind <user|project|knowledge|lab|delivery> --json
+```
+
+`rig workspace validate` walks the workspace root and emits a structured
+frontmatter-gap report against the v0 contract. Exit code is non-zero when
+gaps exist (operators chain into hygiene fix loops). Default root is the
+current directory; pass a positional path to validate elsewhere. `--kind`
+scopes the contract to a specific workspace kind; omit for a kind-agnostic
+structural check.
+
+If `rig workspace validate` reports a non-zero `gapCount` OR the workspace
+root is unset / unwritable, the workspace needs instantiation — see the next
+section.
+
+### Instantiate the canonical workspace scaffold
+
+Agent-actionable. Idempotent on existing dirs without `--force`.
+
+```bash
+rig config init-workspace
+rig config init-workspace --root <path>
+rig config init-workspace --dry-run --json
+```
+
+`rig config init-workspace` scaffolds the canonical workspace layout at the
+configured `workspace.root` (default `~/.openrig/workspace`):
+
+- `missions/` — release missions + slices
+- `progress/` — progress index + per-mission rails
+- `field-notes/` — operator + agent observations
+- `specs/` — spec library (rig + agent + workflow YAML lives here)
+- `dogfood-evidence/` — proof packets + dogfood artifacts
+
+The scaffold seeds two example missions and drops a workspace README.md +
+STEERING.md so a fresh install has browsable Project content. `--root <path>`
+targets a non-default root for this call; `--dry-run` reports what would be
+created without writing. `--force` overwrites existing FILES but never deletes
+directories — operator content is safe.
+
+### Redirect the workspace root
+
+Operator-gated when persistent. Agent-actionable when one-shot via env-var.
+
+For a single command:
+
+```bash
+OPENRIG_WORKSPACE_ROOT=<path> rig <command> ...
+```
+
+For a persistent host-level redirect, the operator changes the config file or
+runs the setter:
+
+```bash
+rig config set workspace.root <path>
+```
+
+ConfigStore precedence: `OPENRIG_WORKSPACE_ROOT` env > config-file
+`workspace.root` > built-in default `~/.openrig/workspace`. The same
+precedence governs `OPENRIG_WORKSPACE_SPECS_ROOT` → `workspace.specs_root`
+(default `<workspace_root>/specs`).
+
+Prefer the env-var form for one-shot redirects (transparent to operators);
+reserve `rig config set` for changes the operator owns.
+
+### Build a workspace from scratch
+
+Agent-actionable. Same surface as the canonical scaffold above; the
+`workspace.root` cascade handles non-existent host paths.
+
+```bash
+rig config init-workspace --root /path/to/new/workspace
+```
+
+The command creates the root dir if missing (idempotent: existing root +
+populated subdirs is a no-op). Run
+`rig workspace validate /path/to/new/workspace --json` after to confirm the
+contract holds.
+
+### Create a workflow inside an existing workspace
+
+Authoring is operator-or-agent; validation + instantiation are
+agent-actionable.
+
+Workflow spec files live at:
+
+```
+<workspace_root>/specs/workflows/<name>.yaml
+```
+
+`<workspace_root>` resolves via the ConfigStore precedence named above.
+There is no `rig workflow create` verb in v0.3.x — the spec YAML is authored
+directly. Template by hand from the documented schema, or copy a built-in
+starter from `<openrig install>/dist/builtins/workflow-specs/` and adapt.
+Once written:
+
+```bash
+rig workflow validate <workspace_root>/specs/workflows/<name>.yaml --json
+rig workflow instantiate <workspace_root>/specs/workflows/<name>.yaml --json
+```
+
+`validate` returns a structured ok/error report; `instantiate` creates a
+workflow instance + entry-step qitem. Inspect existing surface state with:
+
+```bash
+rig workflow specs --json   # list registered specs (built-in + operator-authored)
+rig workflow list --json    # list active workflow instances
+rig workflow show <instanceId> --json
+```
+
 ## v0.3.x Starter, Workspace, And Plugin Surfaces
 
 OpenRig v0.3.0 adds `rig agent-image`, `rig context-pack`, `rig workspace`, and