fix(onboarding): prevent mitigation steps flashing complete (#2786)

* fix: address cubic review findings on onboarding PR

P1: Add metadata.set('policies', true) after policy fan-out so the
    tracker boolean flag is set.
P1: Log batchTriggerAndWait failures in vendor/risk mitigation fan-outs
    instead of silently ignoring them.
P2: Strip {{#if}}/{{/if}} markers from mixed-content nodes so template
    syntax doesn't leak into rendered policies.
P2: Fix stale onboardingTriggerJobId locking publish button in
    ToDoOverview.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: strip only first marker occurrence to preserve nested conditionals

The global regex flag in stripMarkerText would remove ALL matching
{{#if}}/{{/if}} markers in a subtree, corrupting boundaries of nested
conditional blocks. Removed the g flag so only the first occurrence
(the one that triggered the match) is stripped.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(onboarding): add comprehensive tests for policy template processor

Covers placeholder replacement, inline/multi-node/nested conditionals,
mixed content nodes, edge cases, buildVariables, buildFlags, processTemplate.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(onboarding): treat zero-item steps as complete in tracker

When an org has no vendors or risks, `total > 0 && completed >= total`
evaluates to false, causing those steps to appear stuck forever.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(onboarding): prevent mitigation steps from flashing complete on load

Revert zero-item guard (total === 0 ||) back to (total > 0 &&) — before
totals metadata is set, the default of 0 caused steps to appear complete
then flip back to in-progress once actual totals arrived.

Also add missing risksTotal/risksInfo metadata alongside vendorsTotal
so risk mitigation progress tracks correctly in the UI.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(onboarding): show created/total format for vendor and risk creation steps

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/app/src/app/(app)/[orgId]/components/OnboardingTracker.tsx

@@ -666,15 +666,18 @@ export const OnboardingTracker = ({ onboarding }: { onboarding: Onboarding }) =>
                 }
 
                 // Simple step row (creation, linkage)
-                const count = step.key === 'vendors' ? uniqueVendorsCounts.total
+                const total = step.key === 'vendors' ? uniqueVendorsCounts.total
                   : step.key === 'risk' ? stepStatus.risksTotal
                   : null;
+                const created = step.key === 'vendors' && stepStatus.vendors ? uniqueVendorsCounts.total
+                  : step.key === 'risk' && stepStatus.risk ? stepStatus.risksTotal
+                  : 0;
                 return (
                   <div key={step.key} className="flex items-center gap-2">
                     {stepIcon}
                     <span className={`${stepTextClass} flex-1`}>{step.label}</span>
-                    {count !== null && count > 0 && (
-                      <span className="text-muted-foreground text-sm">{count}</span>
+                    {total !== null && total > 0 && (
+                      <span className="text-muted-foreground text-sm">{created}/{total}</span>
                     )}
                   </div>
                 );

apps/app/src/trigger/tasks/onboarding/onboard-organization.ts

@@ -151,6 +151,13 @@ export const onboardOrganization = task({
             payload.organizationId,
             organization.name,
           );
+          metadata.set('risksTotal', created.length);
+          metadata.set('risksCompleted', 0);
+          metadata.set('risksRemaining', created.length);
+          metadata.set(
+            'risksInfo',
+            created.map((r) => ({ id: r.id, name: r.description?.slice(0, 80) ?? r.id })),
+          );
           if (created.length > 0) {
             created.forEach((risk) => {
               metadata.set(`risk_${risk.id}_status`, 'assessing');