fix(wechat): deliver new-user welcome after handshake

[zs-andy]

Summary

• queue the complete onboarding welcome and registration link only when activation creates a new database user
• consume the first inbound message as the transport handshake so it never enters the Agent conversation
• unlock and deliver the encrypted welcome outbox after that handshake, marking delivery only after all 7 bubbles succeed
• keep existing and reconnected users idempotent: if the user already exists, no welcome is queued

Verification

• pnpm agent:migrations:check
• pnpm lint
• pnpm typecheck
• pnpm test
• pnpm build

Tests cover new-user delivery, existing-user suppression, reconnect idempotency, first-inbound consumption, handshake gating, and all 7 welcome/link bubbles.