feat(onboarding): propagate NEEDS_SIGNUP (code 4) through onboard-driver and muse-signin

bin/onboard-driver.py

@@ -8,7 +8,9 @@ Runs INSIDE the node's netns (via netvm-exec.sh). Reads the identifier
   onboard-driver.py --node muse --service muse --id-type email --step submit
 
 Exit codes: 0 = step done, 2 = APPROVAL_NEEDED (code sent, awaiting OTP),
-3 = NEEDS_HUMAN (multi-account selection needs a person), 1 = failed.
+3 = NEEDS_HUMAN (multi-account selection needs a person),
+4 = NEEDS_SIGNUP (unregistered client email — client must sign up first),
+1 = failed.
 The identifier/code are passed to the local signin script as
 argv (transient, same trust domain — bl is operator infrastructure);
 they never cross a network boundary except inside the already-encrypted
@@ -17,6 +19,7 @@ VM->bl SSH stdin pipe.
 Part of the cred onboarding module (front-door repo, docs/CRED-MODULE.md).
 """
 import argparse
+import datetime
 import importlib.util
 import json
 import subprocess
@@ -54,10 +57,6 @@ def main():
                    help="display-name hint for multi-account selection")
     args = p.parse_args()
 
-    lines = sys.stdin.read().splitlines()
-    identifier = lines[0].strip() if lines else ""
-    code = lines[1].strip() if len(lines) > 1 else ""
-
     if args.service != "muse" or args.id_type != "email":
         print("ERROR: unsupported service/id_type "
               "(muse+email only for now)", file=sys.stderr)
@@ -77,6 +76,11 @@ def main():
         print("ERROR: CDP unreachable on %s" % port, file=sys.stderr)
         return 1
 
+    lines = sys.stdin.read().splitlines()
+    identifier = lines[0].strip() if lines else ""
+    code = lines[1].strip() if len(lines) > 1 else ""
+
+
     if not identifier:
         print("ERROR: no identifier on stdin", file=sys.stderr)
         return 1
@@ -90,9 +94,28 @@ def main():
             return 1
         cmd += ["--otp", code]
     r = subprocess.run(cmd, capture_output=True, text=True, timeout=220)
-    # Propagate the signin script's contract: 2 = OTP prompt reached.
+    # Propagate the signin script's contract:
+    # 0 = done, 2 = OTP prompt reached, 3 = NEEDS_HUMAN, 4 = NEEDS_SIGNUP
     sys.stdout.write(r.stdout)
     sys.stderr.write(r.stderr)
+
+    if r.returncode == 4:
+        log_entry = {
+            "ts": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            "type": "onboarding_needs_signup",
+            "node": args.node,
+            "service": args.service,
+            "email": identifier,
+            "status": "needs_signup",
+            "action_required": "ask_client_to_sign_up",
+            "signup_url": "https://muse.ai"
+        }
+        try:
+            with open("/home/super/Projects/NetVM/job-log.jsonl", "a") as f:
+                f.write(json.dumps(log_entry) + "\n")
+        except Exception:
+            pass
+
     return r.returncode