CLI: auto-create local secrets key file during onboard

Add ensureLocalSecretsKeyFile helper that generates a random 32-byte
master key during onboard if using local_encrypted provider. Move
resolveRuntimeLikePath to cli/src/utils/ for reuse by secrets-key
and existing check modules.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cli/src/commands/onboard.ts

@@ -3,6 +3,7 @@ import pc from "picocolors";
 import { configExists, readConfig, resolveConfigPath, writeConfig } from "../config/store.js";
 import type { PaperclipConfig } from "../config/schema.js";
 import { ensureAgentJwtSecret, resolveAgentJwtEnvFile } from "../config/env.js";
+import { ensureLocalSecretsKeyFile } from "../config/secrets-key.js";
 import { promptDatabase } from "../prompts/database.js";
 import { promptLlm } from "../prompts/llm.js";
 import { promptLogging } from "../prompts/logging.js";
@@ -132,6 +133,13 @@ export async function onboard(opts: { config?: string }): Promise<void> {
     secrets,
   };
 
+  const keyResult = ensureLocalSecretsKeyFile(config, resolveConfigPath(opts.config));
+  if (keyResult.status === "created") {
+    p.log.success(`Created local secrets key file at ${pc.dim(keyResult.path)}`);
+  } else if (keyResult.status === "existing") {
+    p.log.message(pc.dim(`Using existing local secrets key file at ${keyResult.path}`));
+  }
+
   writeConfig(config, opts.config);
 
   p.note(