[TheGreatAxios]

Closes CL-9844.

First launch with zero workbenches landed on /new inside the full shell: empty sidebar, a roles checkbox group (admin/owner/member) gating the composer until it loaded, plus a provider banner if skipped — while the copy promised 'your co-worker sets up the rest'.

• Removes the roles picker from new-workbench-picker entirely (creating a workbench already deploys its worker agent; roles are optional and stay manageable in Settings / the New Agent panel, which keeps its picker).
• createWorkbench loses the roles input and the 'roles' failure stage (clean cutover, no legacy path).
• Zero-workbench benches get first-run framing on /new ('Create your first workbench' + explainer); composer is only gated on having a bench selected.
• E2E: new e2e/browser/new-workbench-first-run.test.ts asserts the heading, the absence of the roles UI, and an enabled composer. Full e2e proof runs in CI (no DATABASE_URL/localhost bind in this env); apps/web unit suite green (123 pass), typecheck/lint/fmt green.

[linear-code]

CL-9844