…erprint

The shared build cache that backs `--mode auto` was keyed by the same
fingerprint EAS Build and EAS Update use (`scripts/generate-fingerprint.js`
via `fingerprint.config.js`). That fingerprint conservatively hashes
build outputs (`ios/build/`, `.gradle/`, IDE state, env-populated
`xcconfig`/`google-services.json`) on the theory that they could
conceivably influence the produced binary. For EAS / OTA that is the
right call: never reuse a build whose inputs you cannot vouch for.

For the agentic cache it is the wrong call. Build outputs are
non-deterministic across worktrees, so two parallel slots on the same
commit produce different keys and never share a cached `.app` — the
cross-worktree win the cache was designed for never lands. Re-running
on the same slot, even on the same branch, can also drift the key as
the build itself mutates hashed inputs.

Add `scripts/perps/agentic/lib/compute-cache-fp.js`, an agentic-local
fingerprint that uses the same `extraSources` (so anything that genuinely
affects the binary still participates) but `ignorePaths` the per-worktree
build artifacts. `bc_fingerprint` now invokes this instead of the
repo-wide script. EAS / OTA pipelines continue to use
`scripts/generate-fingerprint.js` and `fingerprint.config.js` unchanged.

Verified against three worktrees on the same commit
(c06187a, branch=main):

  mm-1: c7fe9e2161109d4ff2e092e068821a2e9984aac5
  mm-5: c7fe9e2161109d4ff2e092e068821a2e9984aac5
  mm-6: c7fe9e2161109d4ff2e092e068821a2e9984aac5

A new unit test asserts the fingerprint is unaffected by poisoning an
ignored path (`ios/build/`).

…ss claim

R1 caught two issues with the initial decoupled-fp design:

B1. `ios/*.xcconfig`, `android/app/google-services.json`, and
    `android/app/src/main/assets/InpageBridgeWeb3.js` were on the
    ignorePaths list. All three are read at build time and embedded in
    the produced binary — ignoring them means the cache could serve a
    binary built against different secrets / Firebase config / runtime
    JS bridge. Remove them.

B2. `createFingerprintAsync` always loads `fingerprint.config.js` and
    merges the project config with caller options. The script's claim
    of "bypassing" the config was wrong — we extend it. Update the
    source comment, README, and bc_fingerprint comment to describe the
    actual relationship.

Add `app/core/InpageBridgeWeb3.js` to extraSources so JS-only changes
to the bridge source still invalidate the cache after we ignore the
generated android-asset mirror.

Tests now assert both halves of the boundary:
- poisoning an ignored path (`ios/build/`) must NOT shift the fp
- poisoning a hashed binary-affecting input (`InpageBridgeWeb3.js`)
  MUST shift the fp

Verified mm-1 and mm-6 (aligned env state) still converge to the same
fp; mm-5 (different `.ios.env` + missing `google-services.json`)
correctly diverges — the cache only reuses across worktrees when the
actual build inputs match.

…poison

R2 found that `createFingerprintAsync(projectRoot, options)` OVERRIDES
the config's `extraSources` rather than merging them — passing only the
bridge source dropped the six project extraSources from
`fingerprint.config.js` (`.yarn/patches`, `.github/workflows`,
`.github/scripts`, `react-native.config.js`, `scripts/build.sh`,
`scripts/setup.mjs`), regressing coverage relative to the project
fingerprint.

Mirror the project's extraSources verbatim in `compute-cache-fp.js` and
append the bridge source. Update the file header comment to describe
the actual override-vs-merge semantics.

R2 nits:
- Test that mutates `app/core/InpageBridgeWeb3.js` now uses a trap-based
  restore helper so a fingerprint failure cannot leave the worktree
  poisoned.
- Add a regression test that poisoning a project extraSource (e.g.
  `scripts/setup.mjs`) shifts the agentic fp, proving the inherited
  extraSources actually participate.

Cross-worktree convergence still works for aligned-env slots (mm-1 ≡ mm-6
on the same env state hash to identical fp); mm-5 correctly diverges
because its `.ios.env` differs.

… merge semantics

R3 left two non-blocking nits, both addressed:

- `_poison_must_shift_fp` no longer clobbers the suite-level EXIT trap.
  Capture the previous trap via `trap -p EXIT` before layering the
  temporary restore trap, then re-install the original via `eval`. An
  early abort inside the helper still triggers `.agent/build-cache`
  cleanup.
- File header comment in `compute-cache-fp.js` was inaccurate: only
  `extraSources` is overridden by caller options; `ignorePaths` is
  merged with the config's list. Comment now matches `@expo/fingerprint`
  0.15.x behaviour.