feat: make member onboarding verifiable without Git commands

[yuzhang-zhong]

Summary

Turn the member onboarding RFC into a verifiable, user-centered flow for people who do not know Git.

• Add teamai members --invite, which generates a self-contained AI-ready invitation from the configured team repo.
• Keep Git commands away from the member and require official browser/device login or out-of-band credential entry; embedded HTTP credentials are redacted.
• Define completion as teamai doctor exiting 0, at least one local team skill being listed for the selected agent, and the member confirming that skill responds in a fresh session.
• Limit doctor hook checks to agents selected during onboarding.
• Give uninitialized admins one actionable next step, and decline to generate invitations for self/HTTP modes where the same workflow would be misleading or unsafe.
• Document the admin and member journey in English and Chinese.

Why code, not another static prompt

A generated invitation uses the admin's real configured repo URL, applies the latest onboarding contract, and can evolve with the CLI. A static prompt cannot reliably prevent a stale/wrong URL, redact embedded credentials, or give automation a trustworthy success signal.

Test plan

• npx vitest run src/__tests__/members.test.ts src/__tests__/doctor.test.ts src/__tests__/index-codebase-help.test.ts — 37 passed
• npm run typecheck — passed
• npm run build — passed
• node dist/index.js members --help — --invite is registered
• node dist/index.js members --invite before initialization — actionable error, exit 1
• node dist/index.js doctor before initialization — concise guidance, exit 1
• npm test — 3024 passed; 69 existing Windows portability failures across path separators, Unix permissions/process assumptions, symlinks, and shell-specific tests. The new member/doctor tests pass in the full run.

Related issue

Related to #517.

[jeff-r2026]

Thanks for this — the tests and bilingual docs are solid work.

Closing it, but I'd like part of it back. Two asks:

1. The doctor fixes are good — resubmit them standalone. Exit 1 on failure, no TGit assumption before init, agent-scoped hook checks — all clean, and unrelated to the onboarding RFC. Bundling them here just makes them wait.

2. members --invite is front-running 给没接触过 Git 的用户：三份可粘贴接入提示词（RFC） #517. That RFC is still open and scoped to "docs only, no code this round," and jimpablo's step-accuracy questions (no gh install, GITLAB_TOKEN scope, the stale master line) aren't settled yet. Let's converge there first. The real win — auto-filling the repo URL and redacting credentials — is worth keeping if we do decide to generate the invite.

Direction's right; it's the timing and packaging. Thanks again.

[yuzhang-zhong]

Thanks, that split makes sense. I pulled the doctor work into #569 and kept members --invite out. While separating it, I noticed the enabled-agent filtering had landed in the second commit, so I moved only that small piece and its test. I also added a built-CLI E2E for exit 0 and exit 1. I'll keep invite generation in #517 until the docs and setup assumptions are settled.