Move the preflight orchestrator to a modular TS implementation under scripts/perps/agentic/preflight/ (run via ts-node), wired to a:ios / a:android / a:setup:*. preflight.sh is now a thin compatibility shim forwarding to preflight.ts, kept temporarily so external callers (farmslot) keep working; remove once they migrate.

- dep reconcile keyed off real artifact/source drift, not package.json mtime
- build-fingerprint drift reporting on cache miss (compute-cache-fp.js --json/--diff, build-cache.sh bc_snapshot/bc_drift, build-cache-cli.sh bridges the hardened cache+lock to the .ts)
- Metro health verification + recovery on Metro start and during the CDP wait
- setup-wallet.sh: account-derivation eval cap 30s->120s, surface the error instead of a silent set -e exit
- repoint cache test scripts to preflight.ts

- spawn emulator/expo via argv instead of bash -c (no env interpolation)
- read build logs with fs.readFileSync instead of spawning cat
- prune honors BUILD_CACHE_RETAIN env (default 5)
- recheck shared cache under post-pod fingerprint before full native build
- distinguish simctl install failure from a missing installed app

…t opt-in

- wrap runIos/runAndroid bodies in try/finally so the per-fingerprint build
  lock is released on every failure path (logger.fail throws), instead of
  leaking it and blocking other worktrees until the stale-lock timeout
- post-pod cache recheck now fails loud in --mode fast (lock/install failure)
  instead of silently falling through to a native build
- IOS_BUILD_TIMEOUT defaults to 0 (no timeout); a ceiling is enforced only when
  set explicitly (e.g. from farmslot) — overloaded machines no longer time out

loadJsEnv merged .js.env only into ctx.env, so spawned children (expo run:ios,
Gradle, the google-services decode) inherited bare process.env and could not see
vars defined only in .js.env (e.g. GOOGLE_SERVICES_B64_ANDROID). Export each
newly-introduced key into process.env, mirroring bash 'set -a; source .js.env'.
Caller-set vars still win (keys already in process.env are untouched).

- always release the pre-pod lock and re-probe the shared cache after pod
  install, even when the fingerprint is unchanged (another worktree may have
  stored an artifact during the pod-install wait)
- release the pre-pod lock before acquiring the post-pod lock, so a failed
  re-acquire never strands a stale mutex on the old fingerprint
- store the build under the pre-pod source fingerprint as an alias and record
  the install under it, so worktrees that compute the pre-pod hash hit the
  cache instead of rebuilding (restores maybe_store_ios_source_cache_alias)

- killTree returns early on a non-positive pid; process.kill(0, sig) would
  otherwise signal the whole process group (including the orchestrator) when a
  spawned child's pid is missing
- post-build storeArtifact now acquires a build lock when none is held (the
  lockless build path), so concurrent worktrees can't corrupt the shared
  fingerprint cache — matches bash bc_with_lock (iOS + Android)