feat: preflight - prerequisites checked and tool paths recorded before wikitool runs; launcher refuses without it (#151, POSIX half)

Files changed:
- .claude/settings.json
- .gitea/workflows/ci.yml
- .gitea/workflows/nightly.yml
- .gitea/workflows/release.yml
- .gitea/workflows/tracker-live.yml
- .github/hooks/wiki-trace.json
- .gitignore
- .vibe/hooks.toml
- AGENTS.md
- CHANGES.md
- EVALS.md
- INSTALL.md
- README.md
- VERSION
- instructions/bootstrap.md
- instructions/preflight.md
- instructions/setup-instance.md
- instructions/upgrade-instance.md
- tools/CONTRACT.md
- tools/README.md
- tools/chemenu/cli.py
- tools/chemenu/commands/dist_cmd.py
- tools/chemenu/commands/docs_verify.py
- tools/chemenu/commands/doctor.py
- tools/chemenu/commands/git_publish.py
- tools/chemenu/commands/migrate_cmd.py
- tools/chemenu/config.py
- tools/chemenu/corpus_cache.py
- tools/chemenu/prerequisites.py
- tools/chemenu/search/ripgrep.py
- tools/chemenu/tests/conftest.py
- tools/chemenu/tests/test_dist_upgrade.py
- tools/chemenu/tests/test_doctor.py
- tools/chemenu/tests/test_preflight.py
- tools/chemenu/toolpaths.py
- tools/preflight.sh
- tools/prerequisites.txt
- tools/run_wikitool.py
- tools/trace-hook
- tools/wikitool

tools/trace-hook

@@ -0,0 +1,25 @@
+#!/bin/sh
+# What the harness hooks call: tools/trace_ingest.py, run by the venv's Python.
+#
+#   tools/trace-hook --source claude-code --event prompt.submitted
+#
+# A hook command is a fixed string in a harness's config file (.claude/settings.json,
+# .github/hooks/wiki-trace.json, .vibe/hooks.toml) and cannot read
+# .wikitool-tools.json. The venv's Python can stand in for the recorded one: the
+# preflight creates it from exactly that interpreter, and it sits at a fixed
+# place - only its layout differs (bin/ everywhere but Windows, Scripts\ there,
+# which is also what Git Bash sees). trace_ingest.py uses the standard library
+# only, so the venv adds nothing it needs; it just makes the interpreter findable.
+#
+# Relying on the script's own shebang (`python3`) is what this replaces: in
+# Git Bash on Windows, `python3` is the Microsoft Store alias.
+#
+# No venv yet - before the preflight has run - means no trace, silently. A hook
+# must never fail the call it observes.
+DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd -P) || exit 0
+if [ -x "$DIR/.venv/bin/python" ]; then
+  exec "$DIR/.venv/bin/python" "$DIR/trace_ingest.py" "$@"
+elif [ -f "$DIR/.venv/Scripts/python.exe" ]; then
+  exec "$DIR/.venv/Scripts/python.exe" "$DIR/trace_ingest.py" "$@"
+fi
+exit 0