test(welcome-template): tighten default-rendered assertions to new agnes verbs

The renderer no longer emits the legacy "da analyst setup" verb (the analyst
flow uses `agnes init`, the admin flow uses `agnes auth import-token`). The
disjunction assertions ("da analyst setup" OR "agnes auth" OR "curl") were
permissive and would have silently kept passing even if the renderer
regressed. Replace them with role-aware assertions that match the actual
emitted markers and explicitly check that no legacy verb survives.

tests/test_welcome_template_api.py

@@ -38,8 +38,11 @@ def test_admin_get_template_initially_null(seeded_app):
     # default field must be present and contain the live setup script
     assert "default" in body
     assert body["default"]  # non-empty
-    # Must contain setup-script markers
+    # Admin layout marker — `agnes auth import-token` is the login step.
-    assert "agnes auth" in body["default"] or "uv tool install" in body["default"] or "curl" in body["default"]
+    assert "agnes auth" in body["default"]
+    assert "uv tool install" in body["default"]
+    # No legacy verb in the rendered default
+    assert "da analyst setup" not in body["default"]
 
 
 def test_admin_can_set_and_reset_template(seeded_app):
@@ -198,8 +201,12 @@ def test_setup_page_uses_override_when_set(seeded_app):
     r = c.get("/setup")
     assert r.status_code == 200
     assert "Custom setup script" not in r.text
-    # Default contains setup_instructions output
+    # Default `/setup` is the analyst layout, which uses `agnes init`
-    assert "da analyst setup" in r.text or "agnes auth" in r.text or "curl" in r.text
+    # (auth + workspace bootstrap rolled into one).
+    assert "agnes init" in r.text
+    # No legacy verb anywhere in the rendered default
+    assert "da analyst setup" not in r.text
+    assert "da sync" not in r.text
 
 
 def test_get_template_default_field_has_server_url_placeholder(seeded_app):

tests/test_welcome_template_renderer.py

@@ -39,23 +39,37 @@ def _user(email="alice@example.com"):
 
 def test_returns_default_script_when_no_override(conn):
     """When no override is set, render_agent_prompt_banner returns the live
-    setup script (not an empty string)."""
+    setup script (not an empty string).
+
+    A non-admin user gets the analyst layout: `agnes init` subsumes auth and
+    the trimmed flow has no `agnes auth` line. An admin user gets the full
+    CLI bootstrap with `agnes auth import-token`.
+    """
     out = render_agent_prompt_banner(conn, user=_user(), server_url="https://example.com")
     # Must be non-empty — the default IS the setup script
     assert out != ""
-    # Must contain key markers from setup_instructions.resolve_lines()
+    # Analyst layout: `agnes init` is the bootstrap step.
-    assert "da analyst setup" in out or "agnes auth" in out or "curl" in out
+    assert "agnes init" in out
+    # No legacy verb anywhere in the rendered default
+    assert "da analyst setup" not in out
+    assert "da sync" not in out
 
 
 def test_compute_default_returns_setup_script(conn):
     """compute_default_agent_prompt returns a non-empty string with setup
-    script markers including {server_url} and da-related commands."""
+    script markers including {server_url} and agnes commands.
+
+    Default role is `admin`, which renders the full CLI install + login flow.
+    """
     out = compute_default_agent_prompt(conn, user=_user(), server_url="https://example.com")
     assert out != ""
     # {server_url} placeholder must survive (not replaced by Jinja2)
     assert "{server_url}" in out
-    # Should reference agnes auth or CLI install
+    # Admin layout references the agnes CLI install + login flow
-    assert "agnes auth" in out or "uv tool install" in out
+    assert "agnes auth" in out
+    assert "uv tool install" in out
+    # No legacy verb anywhere in the rendered default
+    assert "da analyst setup" not in out
 
 
 def test_compute_default_server_url_placeholder_survives(conn):
@@ -223,8 +237,9 @@ def test_render_failure_falls_back_to_default_not_exception(conn):
     out = render_agent_prompt_banner(conn, user=_user(), server_url="https://example.com")
     # Must not raise — falls back to the live default script (non-empty)
     assert out != ""
-    # Must contain default setup script markers
+    # Non-admin → analyst layout: `agnes init` is the bootstrap step.
-    assert "agnes auth" in out or "uv tool install" in out or "curl" in out
+    assert "agnes init" in out
+    assert "uv tool install" in out
 
 
 def test_sanitize_applied_after_render(conn):