feat: preflight - prerequisites checked and tool paths recorded before wikitool runs; launcher refuses without it (#151, POSIX half)

Files changed:
- .claude/settings.json
- .gitea/workflows/ci.yml
- .gitea/workflows/nightly.yml
- .gitea/workflows/release.yml
- .gitea/workflows/tracker-live.yml
- .github/hooks/wiki-trace.json
- .gitignore
- .vibe/hooks.toml
- AGENTS.md
- CHANGES.md
- EVALS.md
- INSTALL.md
- README.md
- VERSION
- instructions/bootstrap.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/migrate_cmd.py
- tools/chemenu/config.py
- tools/chemenu/corpus_cache.py
- tools/chemenu/prerequisites.py
- tools/chemenu/search/ripgrep.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_upgrade.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/toolpaths.py
- tools/preflight.sh
- tools/prerequisites.txt
- tools/run_wikitool.py
- tools/trace-hook
- tools/wikitool

CHANGES.md

@@ -59,7 +59,7 @@ concern - readable here, never shipped as something to parse.
 
 ---
 
-## 8.0.0-beta.13 - 2026-09-30 - raw/CONTRACT.md points at the path budget for a name accepted from incoming/
+## 8.0.0-beta.14 - 2026-09-30 - Preflight: prerequisites checked and tool paths recorded before wikitool runs (#151, POSIX half)
 
 **Author:** Torben Nehmer
 
@@ -67,6 +67,7 @@ concern - readable here, never shipped as something to parse.
 - Page titles must form valid, unique file names on Windows and macOS: new and rename refuse forbidden characters, reserved names (including INDEX and COLLECTION), a trailing dot or space, and titles that collide with another page by case or Unicode normalization; lint reports existing violations as hard errors - rename each affected page with tools/wikitool rename
 - publish without --no-push now exits 1 before committing when the remote is unreachable or not configured, where it used to commit locally and fail at the push - an offline session or a local-only instance must pass --no-push
 - new, rename, move and raw accept refuse a target whose path below the instance root is over 160 characters (UTF-16 code units); lint reports existing files over it as Long Paths (advisory) - rename each affected page with tools/wikitool rename, and shorten an incoming/ file name before raw accept
+- tools/wikitool now refuses to start (exit 42) until tools/preflight.sh has passed in the checkout - after updating, run tools/preflight.sh once: it checks Python, git and ripgrep, records their paths in .wikitool-tools.json and sets up tools/.venv
 
 **Migration:** none required - No page format changes; the rule only refuses titles, and each affected page is renamed individually with tools/wikitool rename
 
@@ -75,6 +76,7 @@ concern - readable here, never shipped as something to parse.
 - wikitool: one data record per command - `-h`, index and CONTRACT.md render from cli_contract (Gitea #121 Phase 1)
 - dist upgrade --latest: one-command update from the release feed
 - Page titles must form valid, unique file names on Windows and macOS
+- Preflight: prerequisites checked and tool paths recorded before wikitool runs (#151, POSIX half)
 
 **Medium impact**
 - CalDAV task-tracker provider (Nextcloud Tasks, iOS Reminders); review reports unknown-value findings instead of skipping them
@@ -123,6 +125,32 @@ concern - readable here, never shipped as something to parse.
 - raw/CONTRACT.md points at the path budget for a name accepted from incoming/
 <!-- /wikitool:bumps -->
 
+### Preflight: prerequisites checked and tool paths recorded before wikitool runs (#151, POSIX half)
+
+The Windows install that prompted this found Python missing, then `rg`, and the agent worked
+around each gap instead of stopping. `tools/preflight.sh` is now the one way a checkout gets
+set up. It checks the tools `tools/prerequisites.txt` lists (Python 3.11+, git, ripgrep, and
+PowerShell 7 on Windows) and records each one's absolute path in `.wikitool-tools.json`, which
+is gitignored and per checkout. It then creates `tools/.venv` from the recorded Python with
+`-m venv` and `-m pip`. Anything missing, too old or unusable ends in exit 42 with a numbered
+block for the user: what, why, the command that fixes it, what next. `--set <tool>=<path>`
+takes a path the user names. It is POSIX sh because it has to run before Python is known to
+exist, under dash, bash and Git Bash. On Windows it tries `python`, `py -3`, `python3` in that
+order, never runs a Microsoft Store alias, and records `sys.executable`. With long paths off it
+refuses an install folder over 95 characters, the other half of the 160-character path budget.
+
+`tools/wikitool` is POSIX sh now as well. It stops with exit 42 until the preflight has written
+a complete file, reads both venv layouts, and starts Python through `tools/run_wikitool.py`
+instead of `PYTHONPATH`. Every `git` and `rg` the package starts goes through
+`chemenu.toolpaths`, so it comes from the recorded path rather than the session's `PATH`. A
+path that has gone is an `ERROR` line naming the preflight, not a traceback. `doctor` gains
+`tool-paths` and `install-dir`. The harness hooks start `trace_ingest.py` through
+`tools/trace-hook`, under the venv's Python, because the script's `python3` shebang is the
+Store alias in Git Bash. The CI workflows, `bootstrap.md`, `setup-instance.md` and
+`upgrade-instance.md` run the preflight instead of their own venv steps. The rules an agent
+follows around it are in `instructions/preflight.md`. The PowerShell half and the download
+mode for a first install follow in the same candidate.
+
 ### raw/CONTRACT.md points at the path budget for a name accepted from incoming/
 
 The path budget's close-out review found the raw stage contract silent on it, although `raw