Fix desktop onboarding regressions

[klopez4212]

Summary

• restore neutral identity guidance icons and reveal-first private-key copying
• keep runtime availability sections contiguous and restore primary onboarding colors
• route API-key setup directly to Buzz provider configuration, including slow discovery and signed-out states

Testing

• pnpm check
• pnpm test (6,501 passed)
• focused Playwright onboarding coverage (API routing 3/3; visual flow 1/1)

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is f78a32cf03aa90b0da36b44d075daecd8f85d7d8...745a51cd26d57500feef26f269a6e17849802479.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 745a51cd26d57500feef26f269a6e17849802479 to authorize a new review.
Any previous review applies only to its recorded range.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T13:53:31.768866Z	745a51c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jedwards27]

Review verdict: APPROVE

Reviewed exact head 745a51cd26d57500feef26f269a6e17849802479 against base f78a32cf03aa90b0da36b44d075daecd8f85d7d8.

No author-actionable defects were established across systems/integration and product/UI review.

The changed contracts are coherent:

• buzz-agent selection routes directly to provider configuration without waiting for generic runtime discovery. The parent freezes the selected handoff, so late discovery cannot replace the explicit choice; provider credentials are still validated before completion.
• Signed-out and alternate-harness paths preserve the direct Buzz route while retaining readiness/auth/install handling for other runtimes and a recoverable Back path.
• Runtime ordering groups all available entries before unavailable entries, matching the renderer's single-divider ownership.
• The private key is intentionally fetched and rendered on mount, then blurred on hover/focus while exposing an explicit Copy control. Clipboard access remains click-only, and initial read failures remain retryable. The increased renderer/DOM exposure is the declared reveal-first product behavior, not an accidental bypass.

Verification

At the exact head:

• Desktop JS suite: 6,501/6,501 passed
• pnpm typecheck: passed
• pnpm check: passed (exit 0; informational/warning output only)
• pnpm build: passed
• git diff --check: passed
• GitHub Desktop Core, all four Desktop Smoke E2E shards, Windows build, macOS build, Desktop E2E integration, Semgrep, zizmor, and DCO checks: completed successfully

One attempted local Playwright run was discarded as invalid evidence because it used a normal build rather than the required E2E build recipe; it is not treated as a PR failure.

Residual confidence gap: the review did not independently complete native/browser visual and accessibility interaction observation. Author action: none. Verification owner: reviewer/native tooling. Existing exact-head CI is green.