feat(onboarding): Store agentic setup progress

[evanpurkhiser]

Stack 2 of 5. Previous: #121912. Next: #121914

Persist onboarding runs in Redis with a 24-hour lifetime and opaque, hashed handoff tokens. The service owns registration, resumption, updates, cancellation, ownership checks, and snapshot serialization.

Client-run claiming and state updates use optimistic concurrency so retries remain idempotent and concurrent page loads converge on one run.

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	451	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

[sentry-warden]

Stored onboarding state parsed without JSON error handling

_deserialize calls json.loads without catching JSONDecodeError, causing unhandled crashes when Redis holds empty or corrupted run state. _load only guards against None, so an empty string or corrupted bytes from Redis reaches _deserialize and crashes instead of being treated as a missing run.

Evidence

• _deserialize at line 273 calls json.loads(raw) directly without try/except.
• _load at lines 275-277 passes the raw Redis value into _deserialize after only checking raw is not None; empty strings ("" or b"") pass this guard and trigger JSONDecodeError.
• get, _claim_client_run, and _atomic_update all consume _load or _deserialize.
• A corrupted state value causes an unhandled 500 instead of returning None/RunNotFound as callers expect for missing runs.

_{Identified by Warden · sentry-backend-bugs · GD5-MNF}