Deliver tested project routing during launch

[hmishra2250]

Summary

• deliver the exact tested router card and skill-description guidance for the authenticated Claude/Codex full-bundle launch state
• keep delivery project-scoped, Git-root-safe, provenance-bound, transactional, removable, and persistently opt-out capable
• report configuration truthfully without synthesizing native MCP trust or approval

User journey

The candidate surface is created only after a successful full setup:

firecrawl launch claude --install --yes --project <project>
firecrawl launch codex --install --yes --project <project>

--no-router-card persists opt-out; --remove-router-card removes only managed state; --router-card explicitly re-enables it. Package installation, auth-only commands, MCP-only setup, skills-only setup, keyless states, global instruction files, and unsafe/non-project directories do not receive the card by default.

Stack and evidence boundary

• base state/lifecycle PR: Add managed project router state #158
• transitively stacked on Secure hosted MCP credential setup #155 (secure hosted MCP credentials)
• supersedes the implementation direction in Configure tested Firecrawl routing during launch #154
• candidate only: default-on release remains gated by the fresh P1 router-card release experiment
• no forced --mcp-config, --strict-mcp-config, or synthetic trust state
• frozen card SHA-256: df867193a6fe011342fce14b770e497cf667ca755e396bb16bbb52c513627951
• frozen skill-prefix SHA-256: 4d01a7080b1493975b0ea07a95db17c5a4f3b9030c0f5f237da9e634559c0cbd

Verification

• pnpm test — 418/418 passed
• pnpm run type-check
• pnpm run build
• pnpm run format:check
• independent diff review: GO; no blockers

Review structure

Four commits remain intact and must not be squash-merged: launch integration, merge-safe removal, delivery hardening, and pre-side-effect validation.