[TheGreatAxios]

Summary

• Investigation confirmed apps/hub/src/index.ts already has no boot-time tool-registry publish path (CL-8112 removed the onboarding router; the file only imports CORBITS_TOOLS_REGISTRY for read-back resolution, which stays).
• The one remaining hub-triggered publish path was packages/onboarding/src/desired-state.ts's reconcileTenantDesiredState, which packed and published workspace-pack tool pins via publishCorbitsToolsRegistry. That call is removed: an absent workspace-pack pin now reports blocked, same as any other operator-actionable gap, instead of packing.
• packages/onboarding/src/tenant-seed.ts's now-unused ToolRegistryPublisher type and its import are removed.
• scripts/publish-tools.ts was already the out-of-band API client this decision calls for (sign in, resolve tenant, pack with packToolPackageTarball, PUT through the stock tarball route) — no change needed there.
• Docs (docs/seed-reconciliation.md, docs/local-rip.md) updated to state that nothing hub-triggered ever packs or publishes tool tarballs; bun run publish-tools is the only publisher.

Scope note

Item 4 (a needs-converge/needs-list "tool packages missing" operator message in apps/web) is left for a follow-up: apps/web's client-driven converge loop (CL-8083) has no existing notion of tool-package pins or a registry-tarball read capability on StockHub, so surfacing this cleanly needs a new StockHub method plus wiring, which is out of scope for this bounded change.

Test plan

• bun run typecheck
• bun run lint
• bun run check:structural
• bun --cwd apps/hub test
• bun --cwd apps/web test
• bun --cwd packages/onboarding test
• bun --cwd packages/tool-registry-publish test

[linear-code]

CL-8190