New hire provisioning agent template that onboards across Deel, Workspace, and Notion

if cfg.mode == "create":
    payload = {
        "first_name": hire.first_name, "last_name": hire.last_name,
        "work_email": hire.work_email, "start_date": hire.start_date,
        "legal_entity_id": resolve(execute_tool("deelmcp_org_legal_entity_list")),
        "team_id":         resolve(execute_tool("deelmcp_org_team_list")),
        "department_id":   resolve(execute_tool("deelmcp_org_department_list")),
        "seniority_id":    resolve(execute_tool("deelmcp_lookup_seniority_list")),
    }
    if cfg.dry_run:
        return logger.info("DRY RUN, would create: %s", payload)
    execute_tool("deelmcp_org_direct_employee_create", data=payload)
else:
    hires = execute_tool("deelmcp_onboarding_tracker_list")   # scan mode, read only

# DWD needs all four scopes granted together, or every call 401s:
#   openid, userinfo.email, userinfo.profile, admin.directory.user
try:
    execute_tool("googledwd_create_admin_user", identifier=cfg.workspace_super_admin,
        tool_input={"primary_email": hire.work_email,
                    "given_name": hire.first_name,
                    "family_name": hire.last_name,
                    "password": generated_password(),
                    "change_password_at_next_login": True})
    state.mark_step_done(fingerprint, STEP_WORKSPACE)
except ConnectorError as exc:
    logger.warning("Workspace skipped, Notion and Slack still run: %s", exc)

if not notion.verify_parent(cfg.notion_parent_page_id):
    raise ConfigError("Share the onboarding hub page with your Notion integration")

existing = execute_tool("notionmcp_notion-search", identifier=notion_user,
                        tool_input={"query": title})
if not existing:
    page = execute_tool("notionmcp_notion-create-pages", identifier=notion_user,
        tool_input={"parent": {"type": "page_id", "page_id": cfg.notion_parent_page_id},
                    "pages": [{"properties": {"title": title},
                               "content": render_onboarding(hire)}]})
    state.mark_step_done(fingerprint, STEP_NOTION, {"page_id": page["id"]})

channel_id = slack.resolve_channel(cfg.welcome_channel)
execute_tool("slackmcp_slack_send_message", identifier=slack_user, tool_input={
    "channel_id": channel_id,
    "message": (f"Welcome {hire.first_name}! Starting {hire.start_date} on "
                f"{hire.team}. Onboarding doc: {notion_url}"),
})
state.mark_step_done(fingerprint, STEP_SLACK)

# rerun-safe: already-provisioned hires are skipped, not repeated
if state.is_fully_provisioned(fingerprint,
        required_steps=(STEP_WORKSPACE, STEP_NOTION, STEP_SLACK)):
    logger.info("%s fully provisioned", hire.work_email)