feat: preflight - prerequisites checked and tool paths recorded before wikitool runs; launcher refuses without it (#151, POSIX half)

Files changed:
- .claude/settings.json
- .gitea/workflows/ci.yml
- .gitea/workflows/nightly.yml
- .gitea/workflows/release.yml
- .gitea/workflows/tracker-live.yml
- .github/hooks/wiki-trace.json
- .gitignore
- .vibe/hooks.toml
- AGENTS.md
- CHANGES.md
- EVALS.md
- INSTALL.md
- README.md
- VERSION
- instructions/bootstrap.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/migrate_cmd.py
- tools/chemenu/config.py
- tools/chemenu/corpus_cache.py
- tools/chemenu/prerequisites.py
- tools/chemenu/search/ripgrep.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_upgrade.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/toolpaths.py
- tools/preflight.sh
- tools/prerequisites.txt
- tools/run_wikitool.py
- tools/trace-hook
- tools/wikitool

instructions/setup-instance.md

@@ -193,15 +193,17 @@ and ready for its first ingest.
    `FAIL`, and so is one still carrying the sentinel - a renamed template is not a filled-in
    one.
 
-7. **Create the tool environment** (details: [bootstrap.md](bootstrap.md)):
+7. **Run the preflight** ([preflight.md](preflight.md)). It checks Python, git and ripgrep,
+   records their paths in `.wikitool-tools.json` and creates `tools/.venv` - no `tools/wikitool`
+   call works before it has passed:
 
    ```bash
-   cd tools
-   python3 -m venv .venv
-   .venv/bin/pip install -r requirements.txt
-   cd ..
+   tools/preflight.sh
    ```
 
+   On exit 42, show its output to the user verbatim and wait; run it again once they have
+   acted. Continue here only after it exits 0.
+
 8. **Publish the skills:**
 
    ```bash