fix/refactor: 2026-09-11 audit execution, successor to #2409

## Purpose

Execute the vetted findings of the 2026-09-11 codebase audit (26 rows, four parallel static audits, every row re-verified at `eefe37b51e` by read-only verifiers, then the execution shape adversarially reviewed). Successor to #2409 (vertical cost) and #2335 (decoupling wave 3). This umbrella is reliability and repo truth, not features: after wave 2 the primitives under every command (spawn, deadline, kill, lock, runner recovery) are honest.

Rules for every child:

- Fix-shaped, not detector-shaped. No new ratchet, validator, guard script or helper module unless the child says so. The 2026-09-02 review ranked enforcement machinery as the top waste.
- Behavior changes land with characterization tests observed on unmodified code first.
- One local full gate per branch; stacked PRs share the tip's gate.
- No collocation file moves (measured zero effect in #2409); no refactor inside the lock child.

## Children (waves = independent branches; ← = stack order)

Wave 1
- [x] #2519 daemon death on discarded rejection — PR #2532, merged 2026-09-13
- [x] #2520 docs and manifests truth — PR #2533, merged 2026-09-13
- [x] #2521 config drift: overrides, fallow roots, worktree, prettier — PR #2535, merged 2026-09-13

Wave 2
- [ ] #2522 host-kit exec: settle-on-exit ← then background type narrowing and opt-in cap (M, MED risk)
- [ ] #2523 host-kit process lock ownership (M, MED risk)
- [ ] #2524 apple-runner typed recovery; deadline gets zero recovery today (M, MED risk)
- [ ] #2525 shellQuote dedupe (S)

Wave 3
- [x] #2526 Windows auth URL launch without `cmd /c` — PR #2567, merged 2026-09-14
- [x] #2527 Android helper build-tools pin, hard-fail on CI — PR #2568, merged 2026-09-14
- [ ] #2528 scroll-until visibility index once per pass (S)
- [ ] #2529 decision: size tiers in AGENTS.md (delete or generalize the existing ratchet)

Last
- [ ] #2530 stop copying `.env` into worktrees (touches `.worktreeinclude` after #2521)

## Evaluated and not scheduled

- Android helper tests "never run": refuted. They run in CI via the `android-helpers` gate from `android.yml`; they are never in the APK.
- Torture lane asserts its own model: documented scope; a real SIGKILL lane exists (`test/integration/daemon-replace-exit-flush.test.ts`).
- Maestro `runScript` trust boundary: flows are operator-authored; env visibility mirrors upstream.
- Bearer token accepted in the JSON-RPC body: shape since #985, proxy rewrite is intentional, loopback plus 192-bit token, no attacker model. Unpinned by tests.
- Mobile snapshot presentation computed twice (daemon keeps counts, CLI recomputes nodes): real, cross-platform, distinct from #2383; deferred to the capture-kit move (H2) because the fix changes the `visibility` wire field.
- `runCmd` timeout wedge frequency: mechanism confirmed and fixed in #2522; no separate diagnostic.

## Needs a maintainer decision (no issue filed)

- `.ad` device-replay corpus has no automatic lane; iOS parked since 2026-07-24 by #1781 A1 with no open tracking issue and no kill criterion. Reactivate or delete.
- `packages/managed-allocation` has one production consumer; ADR 0021 never names the package boundary. Keep while the Simlock plan is alive.
- `undici` bundled behind a caret override: aligned to the exact pin in #2521; vendoring policy stays open.

## Reconciliation 2026-09-14 (main `730b20149e`)

- #2519 site 2 (the `Promise.race` loser in `rollbackAcquiredSimulatorProcess`) was a false finding: `Promise.race` subscribes to every member, so a losing rejection is handled. PR #2532 correctly left it; three sites fixed.
- #2520: `engines.node` stays `>=22.12` on purpose. CI verifies the published tarball on 22.12; 22.13 is the contributor requirement for the pinned pnpm and is now documented in CONTRIBUTING. Better than the issue asked.
- Wave 1 complete. Wave 2 (#2522, #2523, #2524, #2525) not started; no branch or PR exists. Wave 3: two of four done; #2528 and #2529 open. #2530 waits on #2529 only by convention, not by file overlap now that #2521 landed.