fix(desktop): keep machine onboarding for unrecognized identities after reset

[wpfleger96]

After a dev-build sign-out+reset, the Rust webview wipe renames ~/Library/WebKit/<bundle_id> — the correct path for installed .app builds. In tauri dev builds WebKit keys storage by process name (buzz-desktop/), so this wipe is a no-op and the frontend's localStorage survives the reset. The migrateMachineOnboardingCompletion heuristic added in #1936 then sees the stale active-community entry and auto-marks the freshly generated key as onboarded, skipping the machine-onboarding screen entirely — including the "Use an existing key" button.

Fix A — pubkey-sound completion heuristic

migrateMachineOnboardingCompletion in machineOnboarding.ts now accepts activeCommunityPubkey: string | null | undefined instead of a bare hasConfiguredCommunity: boolean. The community arm grants only when the recorded pubkey exactly matches the current pubkey — both absent pubkey (null) and no community (undefined) do not vouch.

Community-creation paths now stamp pubkey at write time so that absent means genuinely pre-stamp:

• App.tsx first-community flow (handleCommunityOnboardingConnect): stamps pubkey: currentPubkey ?? undefined, where currentPubkey is threaded down from MachineBootstrap.
• AppShell.tsx onAddCommunity callback: stamps community.pubkey ?? identityQuery.data?.pubkey. Note: AddCommunityDialog never calls its onSubmit prop — it routes all submissions through communityOnboarding.start — so this callback is currently unreachable. The stamp is correct if the dead prop is ever wired up; it costs nothing now.

The other two migration arms (completedLegacyOnboarding — already pubkey-scoped — and isSharedIdentity) are unchanged. Sprout-era veterans are safe: legacyCommunityStorage.ts migrates sprout-onboarding-complete.v1:<pubkey> → buzz-onboarding-complete.v1:<pubkey> on first Buzz launch, and the v1 key predates community storage (#386 vs #409), so every legacy community's creator already holds a pubkey-scoped v1 entry.

Files: machineOnboarding.ts, App.tsx, AppShell.tsx

Fix B — sign-out clears origin web storage on success

The confirm handler for "Delete My Data" in ProfileSettingsCard.tsx now calls window.localStorage.clear() + window.sessionStorage.clear() immediately after signOut() resolves. This closes the dev-build gap directly at the sign-out call site.

• Clears on the resolve path only — a failed sign-out must not wipe a still-running app.
• In production the Rust wipe already handles this; the clear is redundant but harmless.
• The restart may race the clear — acceptable. Fix A is the correctness gate; Fix B is belt-and-braces.

Files: ProfileSettingsCard.tsx

E2E fixture fix — seedDefaultCommunity pubkey stamp

seedDefaultCommunity in desktop/tests/helpers/bridge.ts now stamps pubkey on the fixture community. The init script reads buzz:e2e-identity-override.v1 from localStorage (written by seedActiveIdentity, which always runs before installMockBridge across all affected specs), validates its shape against the same three-field check as readStoredIdentityOverride() (privateKey, pubkey, and username must all be strings), and uses the override pubkey when valid. Malformed JSON, stored null, and partial objects fall through to the fallback pubkey (identity?.pubkey ?? DEFAULT_MOCK_PUBKEY). This ensures the fixture community's provenance matches the active identity the strict voucher checks.

Six previously-failing smoke specs now pass: onboarding-avatar-skip.spec.ts (×5) and onboarding-docked-cta-screenshots.spec.ts (×1). These specs seed BLANK_TYLER_IDENTITY via seedActiveIdentity + skipOnboardingSeed: true, so the default community was their only voucher.

Files: desktop/tests/helpers/bridge.ts

Tests

Seven unit tests in machineOnboarding.test.mjs:

• Mismatched community pubkey → NOT vouched (original regression case)
• Matching community pubkey → vouched
• Absent community pubkey (null) → NOT vouched (stale current-format community + no stamp + fresh identity)
• No community (undefined) → NOT vouched
• Legacy v1 completion key → granted
• Shared identity → always granted
• Already-completed v2 key → returns true immediately

Playwright coverage: onboarding-avatar-skip.spec.ts (5/5), onboarding-docked-cta-screenshots.spec.ts (3/3), onboarding.spec.ts (57/57), deep-link-invite.spec.ts (included in combined run above, no regressions).

import.meta.env guard

forceMachineOnboarding() reads import.meta.env.DEV — Vite inlines this at bundle time, but the Node test runner has no import.meta.env. Added ?.DEV optional chain so the function returns false in test context. No behavior change in any built artifact.