Add --mode <auto|fast|rebuild-native|clean> to preflight.sh with a
two-tier build cache keyed by @expo/fingerprint. Cache lives in
$MM_BUILD_CACHE_DIR (default ~/Library/Caches/mm-mobile-builds)
plus a per-worktree installed.json sidecar at .agent/build-cache/.

Why: farmslot dispatches every task with --clean, forcing full
yarn setup + pod install --repo-update + xcodebuild (~15-20 min)
even when native deps are identical. auto mode reuses an existing
build whenever the fingerprint matches, dropping warm dispatches
to under 90s. Parallel worktrees at the same fingerprint share one
artifact via flock — only the first builds, the rest install from
cache.

Modes:
  auto           skip build on fingerprint hit; pod install w/o
                 --repo-update; falls back to retry with --repo-update
                 on failure
  fast           fail loud if no cached/installed app
  rebuild-native skip yarn setup, force native rebuild
  clean          preserves current --clean semantics (escape hatch)

Includes idempotent test suites:
  scripts/perps/agentic/lib/test-build-cache.sh         (26 unit tests)
  scripts/perps/agentic/lib/test-preflight-cache-e2e.sh (real-sim e2e)

…wnership)

Drop a:auto:{ios,android} and a:fast:{ios,android} from root package.json
so the change is fully contained inside scripts/perps/agentic/. Callers
invoke preflight.sh directly with --mode auto|fast|rebuild-native|clean.
README updated to show the direct invocation.

…ast-fail

Round 1 review feedback:
- B1: --check-only is now read-only on cache hits. Guarded the cache install
  with !$CHECK_ONLY for both iOS and Android; in check-only the script fails
  loud naming the fp mismatch instead of mutating the sim/device.
- B2: cache install failure used to leave APP_INSTALLED stale after the
  uninstall; reset to 0 before install attempt so a failed install can't
  silently skip the rebuild.
- B3: --mode fast now hard-fails when a cached artifact exists but its
  install fails, instead of falling through to a native build.
- B4: per-fingerprint flock now wraps the full cache-decide + build + store
  region, not only the post-build store. Two peer worktrees at the same
  fingerprint now produce exactly one xcodebuild/gradle invocation; the
  second installs from the cache published by the first.
- B5: installed.json target is now validated against SIM_TARGET / ADB_TARGET
  before the fast-path skip, so a recorded fp from a different sim no
  longer false-hits.
- N1: bc_prune now uses a portable mtime helper (BSD stat -f → GNU stat -c
  fallback), keeping LRU correct on Linux farmslot hosts.
- N2: bc_has_artifact rejects empty .app dirs (missing Info.plist) and
  zero-byte .apk files so a half-written or aborted store can't be hit.
- N3: tests no longer call GNU `timeout`; a portable `_capture_for` helper
  uses a backgrounded watchdog so the suites run on base macOS.
- N4: bc_record_install and bc_store_artifact now write JSON through jq
  with --arg, escaping arbitrary paths/targets correctly.

…se --clean+--check-only

Round 3 review feedback (both actionable nits handled):
- N1: --check-only summary no longer claims "App installed and at the right
  fingerprint" when the fingerprint was not actually verified. Tracks a
  CHECK_ONLY_FP_VERIFIED flag set only by the Path-1 cache hit, then prints
  one of two messages based on whether verification actually happened.
- N2: --check-only combined with --mode clean / legacy --clean now fails
  loud at arg-parse time instead of briefly running yarn setup before the
  late short-circuit. The two flags are inherently contradictory (clean is
  destructive, check-only is read-only).

R5 flagged the previous /tmp/bc-fp-\$\$ memo as symlink-attackable: a
local attacker who knows the next bash PID can pre-create a symlink at
that path and our `>` redirection would clobber an arbitrary file the
attacker has write access to through the symlink target.

Switch to a private 0700 dir created by `mktemp -d` at preflight startup
and exported as BC_MEMO_DIR so command-substitution subshells inherit
the same path. bc_fingerprint refuses to trust the memo file unless it
is a regular file (not a symlink) inside our private dir, and falls
back to per-call computation when BC_MEMO_DIR is unset (lib used
stand-alone). Tests clean up the dir on exit.

Bash imports any exported env var as a regular shell var on startup, so
the previous "non-exported flag" defense was bypassable: a parent could
run `BC_MEMO_DIR=/tmp/victim BC_MEMO_DIR_OWNED=1 preflight.sh` and the
child shell would see both, treat the inherited dir as owned, and
recurse a destructive delete on reset_memo.

Fix: bc_fingerprint_reset_memo now `unset`s both BC_MEMO_DIR_OWNED and
BC_MEMO_DIR before calling bc_memo_init, without ever calling
bc_memo_cleanup on the inherited values. Any pre-existing claim from
env is discarded; only ownership we set ourselves in this shell, after
mktemp -d returns, will ever satisfy the cleanup guard.

New test reproduces the R8 attack (BC_MEMO_DIR=victim plus forged env
BC_MEMO_DIR_OWNED=1) and asserts the victim dir is preserved.

…uninstall)

Reviewer flagged that the cache-hit install path was destroying wallet/
app container data even when neither --clean nor --wallet-setup was
requested, because it ran `simctl uninstall` / `adb uninstall` before
installing the cached artifact. origin/main only uninstalled under
DO_CLEAN || DO_WALLET_SETUP.

`simctl install` and `adb install -r` both reinstall the bundle in
place and keep the existing container by default, so the preemptive
uninstall was unnecessary. Drop it on both platforms. On install
failure we reset APP_INSTALLED=0 so the build branch still fires
(or --mode fast still hard-fails).

The default-mode cache opt-in flagged in the second comment is kept
deliberately and documented as a wanted behavior change in
preflight.sh's mode banner and the README.

…evice

Bugbot found that the Android build branch guarded the --wallet-setup
uninstall on APP_INSTALLED > 0, but the new cache-decision phase zeroes
APP_INSTALLED on cache miss even when the app is still physically on
the device. The result: --wallet-setup runs adb install -r over the
old container, preserving stale wallet data.

Replace the stale-count guard with a live `adb shell pm list packages`
check, independent of the cache-decision state. iOS already used an
unguarded uninstall, no fix needed there.