feat(onboarding): redesign repo integration journey

custodian_cli.py:
- register-project now writes CLAUDE.custodian.md (suggestion) instead
  of overwriting CLAUDE.md; includes preamble with integration instructions
- registers repo via POST /repos/
- creates a "Repo Integration: {slug}" workstream in the domain's topic
  with 4 onboarding tasks (integrate CLAUDE.md, first workplan, SBOM,
  EPs/TDs); checks for existing workstream to be idempotent
- fixes {REPO_SLUG} template substitution (previously missing)

dashboard:
- repos.md: fetches workstreams; detects active repo-integration-* slugs;
  adds "Integrating" KPI card; shows ⚙ integrating badge per repo in
  coverage map and table; replaces "How to Ingest a Repo" with
  "Onboard a New Repo" 4-step panel with doc help button
- docs/repo-integration.md (new): full collaboration model doc — custodian
  as coach, repo agent as executor; journey, generated tasks, first session
  protocol, ongoing relationship
- docs/repos.md: links to new repo-integration doc; updates "What is a
  managed repo?" section; adds onboarding quick reference
- docs/reference.md: fix latent build error — code examples were in ```js
  fences (executed by OF); changed to ```javascript (display only)
- observablehq.config.js: adds "Repo Integration" to Reference nav

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

dashboard/src/docs/repos.md

@@ -12,9 +12,13 @@ their SBOM ingestion status, and a domain-grouped coverage map.
 ## What is a managed repo?
 
 A managed repo is a git repository that has been registered with the state hub
-via `make add-repo` or `register_repo()`. Registration records the repo's slug,
-domain, local path, and optional remote URL. Once registered, the repo can
-receive SBOM ingestion and is eligible for the ADR-001 workplan validator.
+via `custodian register-project` or `register_repo()`. Registration records the
+repo's slug, domain, local path, and optional remote URL. Once registered, the
+repo receives a `CLAUDE.custodian.md` integration suggestion, an onboarding
+workstream with 4 tasks for the repo agent, and is eligible for SBOM ingestion
+and the ADR-001 workplan validator.
+
+For the full onboarding journey see **[Repo Integration](/docs/repo-integration)**.
 
 ---
 
@@ -52,14 +56,22 @@ Rows with no SBOM are highlighted in amber.
 
 ---
 
+## Onboarding a new repo
+
+See **[Repo Integration](/docs/repo-integration)** for the full journey.
+
+Quick reference:
+
+```bash
+# From the repo root — registers, writes CLAUDE.custodian.md, creates onboarding tasks
+custodian register-project --domain <slug>
+```
+
 ## Ingesting a repo's SBOM
 
 ```bash
-# Register a new repo
+# Auto-detects lockfile at repo root
 cd ~/the-custodian/state-hub
-make add-repo DOMAIN=<slug> SLUG=<repo-slug> NAME="Display Name" PATH=/absolute/path
-
-# Ingest SBOM (auto-detects lockfile at repo root)
 make ingest-sbom REPO=<slug> REPO_PATH=/absolute/path
 
 # Multi-ecosystem repo — scan all lockfiles recursively