feat: preflight - prerequisites checked and tool paths recorded before wikitool runs; launcher refuses without it (#151, POSIX half)

Files changed:
- .claude/settings.json
- .gitea/workflows/ci.yml
- .gitea/workflows/nightly.yml
- .gitea/workflows/release.yml
- .gitea/workflows/tracker-live.yml
- .github/hooks/wiki-trace.json
- .gitignore
- .vibe/hooks.toml
- AGENTS.md
- CHANGES.md
- EVALS.md
- INSTALL.md
- README.md
- VERSION
- instructions/bootstrap.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/migrate_cmd.py
- tools/chemenu/config.py
- tools/chemenu/corpus_cache.py
- tools/chemenu/prerequisites.py
- tools/chemenu/search/ripgrep.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_upgrade.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/toolpaths.py
- tools/preflight.sh
- tools/prerequisites.txt
- tools/run_wikitool.py
- tools/trace-hook
- tools/wikitool

.gitea/workflows/ci.yml

@@ -90,21 +90,27 @@ jobs:
           fetch-depth: 0
 
       - name: Tool environment
+        # The preflight, not a venv block of our own: it is the one way a
+        # checkout gets set up (instructions/preflight.md), and tools/wikitool
+        # refuses to start until it has passed. Run twice - the second run must
+        # pass without changing anything, which is what an instance relies on
+        # when it re-runs it after every update.
         run: |
           set -eu
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          python3 -m venv tools/.venv
-          tools/.venv/bin/pip install --quiet --upgrade pip
-          tools/.venv/bin/pip install --quiet -r tools/requirements.txt
+          tools/preflight.sh
+          cp .wikitool-tools.json /tmp/tools-first.json
+          tools/preflight.sh > /tmp/preflight-second.txt
+          cmp .wikitool-tools.json /tmp/tools-first.json
           # pytest-cov is CI-only: tools/requirements.txt describes what an
           # *instance* needs at runtime and ships with `dist export`, and an
           # instance does not measure this suite. Installed beside pytest for
           # the same reason pytest itself is.
-          tools/.venv/bin/pip install --quiet pytest pytest-cov
+          tools/.venv/bin/python -m pip install --quiet pytest pytest-cov
           # The MCP server's dependency is optional for an instance but not for
           # CI: its tests skip without it, and a skipped golden test is exactly
           # how the server's output and the CLI's would drift apart unnoticed.
-          tools/.venv/bin/pip install --quiet -r tools/requirements-mcp.txt
+          tools/.venv/bin/python -m pip install --quiet -r tools/requirements-mcp.txt
 
       - name: Tests
         # Not run with WIKI_TRACE=0: two telemetry tests assert that a trace is
@@ -137,7 +143,7 @@ jobs:
         # $GITHUB_ENV, which only reaches the steps after the one that wrote it.
         run: |
           set -eu
-          tools/.venv/bin/pip install --quiet radicale
+          tools/.venv/bin/python -m pip install --quiet radicale
           .gitea/scripts/start-radicale.sh tools/.venv/bin/python /tmp/radicale
 
       - name: Live tracker suite (CalDAV)
@@ -258,8 +264,15 @@ jobs:
           for template in kb/*/COLLECTION.md.template types/*.template; do
             cp "$template" "${template%.template}"
           done
-          python3 -m venv tools/.venv
-          tools/.venv/bin/pip install --quiet -r tools/requirements.txt
+          # A fresh instance refuses to run before its preflight (exit 42), so
+          # this proves both halves: the refusal, then the setup that ends it.
+          set +e
+          tools/wikitool doctor > /tmp/before-preflight.txt 2>&1
+          refused=$?
+          set -e
+          test "$refused" -eq 42
+          grep -q 'tools/preflight.sh' /tmp/before-preflight.txt
+          tools/preflight.sh
           tools/wikitool instructions sync
           tools/wikitool index rebuild
           tools/wikitool sources rebuild-index