fix(install): reorder the tunnel questions, drop second-account support, default auto-update to yes

[jmvbambico]

Three changes to the setup flow.

1. The tunnel provider is asked before the ngrok domain

build_plan_interactive asked for a reserved ngrok domain before asking which tunnel provider to use, so users answered an ngrok-only question before saying whether they wanted ngrok. The order is now provider → ngrok domain → tunnl SSH key, and the domain is skipped entirely when the provider is tunnl. A stored ngrok_domain is carried through unchanged on the tunnl path, so switching to tunnl and back does not lose a reserved domain. emit_questions() emits the same new order, since an AI driving --questions asks them as emitted. This also makes the code match README.md, which already documented provider-first.

2. The second-Claude-account feature is removed

Removed in full: the interactive question, the accounts plan key, account_entries(), account_note(), the {{ACCOUNT_NOTE}} placeholder in the reviewer/scout/integrator templates, the validate() shared-env check, the write_og_env OG_<env>= loop, the emit_questions accounts question, the show() account line, multi_account in registry.json, the OG_CLAUDE_CONFIG_DIR → CLAUDE_CONFIG_DIR export and its OMNIGENT_RUNNER_ENV_PASSTHROUGH entry in bin/og, the account: ... diagnostic, and the prose in AGENTS.md, README.md, docs/ARCHITECTURE.md and docs/TROUBLESHOOTING.md.

The foreground-host / env-passthrough machinery in bin/og serves more than this feature, so it is kept with only the account-specific clauses stripped — the OPENCODE_* passthrough is intact.

Backward compatible: an existing ~/.omnigent/og-install.json holding "accounts": {...} still installs. The key is ignored rather than refused, and is round-tripped inert rather than stripped, so a downgrade stays safe.

3. Auto-update always defaults to yes

The default came from saved state, so a user who once answered n saw (y/N) on every later re-run. It is now a literal True: the prompt always renders (Y/n), Enter means yes, and only an explicit n turns it off.

Verification

• 293 tests pass (was 292); bash -n and shellcheck -S error clean on bin/og and install.sh.
• Sandbox install (per AGENTS.md, never the live ~/.omnigent) exits 0 on a clean plan, on a legacy plan carrying a stale accounts key, and on a rerun over the same sandbox. All 7 generated YAML files parse.
• No generated file contains CLAUDE_CONFIG_DIR, OG_CLAUDE_CONFIG_DIR, ACCOUNT_NOTE or multi_account.
• Omnigent loader resolves every model pin; the only None is the registry-sanctioned unpinned codex reviewer.
• Prompt size 8665/13300 bytes shell-quoted — byte-identical to main.

Six tests added, including a guard that no account wiring survives in installer/og_install.py or bin/og, and an interactive test proving the ngrok-domain prompt is absent under tunnl rather than merely defaulted.

cross-vendor-review: passed

Implemented by a deepseek worker, reviewed independently by an OpenAI reviewer. The review raised one blocking issue — a restored claude-native rationale comment in orchestrator.yaml.tmpl whose non-account content was still relevant — which is fixed in 3265646, plus two test-coverage suggestions that were adopted. Re-review returned no blocking issues.

🤖 Generated with Claude Code