#1433 Post-0.64 batch 3

Post-0.64 batch 3: the 17 deliveries assembled as batch 3, replayed onto batch 2's final tip (398e5549, the same tree as main 9b505ee5), plus 12 later deliveries.

Highlights:

• A call-graph refresh that touches more than max(1024 files, 25%) drops its engine and rebuilds from stored records (peak 3.6 GB to 2.1 GB on a rebase-sized change).
• OpenCode 2 Code Mode can call AFT's read-only tools (issue #1004).
• On Linux, agent shell commands are the kernel's first choice when memory runs out (issue #750).
• Issue #1432: shell-command logs and AFT's issue report never carry a password set inline, and standalone grep no longer blocks status.
• Status pushes stop reading meaning-search stores and backup metadata (CPU per push down about 60%).
• Shell launches stop running git to name the checkout's GitHub repository when nothing changed (7.3 ms to 0.21 ms on macOS).
• read(pr://N) shows each review thread's id and state.
• aft_search rerank scans only lines that can hold the phrase (byte-identical on 6,897 queries).
• Shared idle services replace about 650 per-root threads.
• The index store publishes on macOS mounts without full-sync support (it falls back to fsync and counts that in health).
• Release builds ship Linux debug symbols and Windows PDBs as separate archives.
• Linux CI runs the real-daemon tool-provider tests.

Issues are referenced as (#N) only, and get closed by hand after release.

---

Summary by cubic

Lands the post-0.64 batch 3 deliveries: performance and cost reductions across search, status, and shell execution, plus security and correctness fixes.

Performance & memory

• Call-graph refresh drops its engine and rebuilds from stored records when invalidation exceeds max(1024 files, 25%), cutting peak memory from 3.6 GB to 2.1 GB; extracted records are reused on cold fallback.
• Status pushes skip checkpoint locks, meaning-store rebuilds, and compression scans (~60% CPU per push) and read tracked-file counts from a cached inventory; status dialogs show unknown checkpoint counts as —.
• Shell launches stop running git when nothing changed (7.3 ms to 0.21 ms); per-spawn git helpers skip git config and git worktree list on warm cache hits; unchanged background metadata skips repeated writes and fsyncs; shared idle timers and native FSEvents delivery replace ~650 per-root threads; per-root LSP applicability walks coalesce with a settle window and one follow-up.
• aft_search rerank prepares only phrase-capable lines; standalone grep reads large files without blocking status; cross-repository search keeps index-store reads and drops unused unbounded trigram builds and saved-index comparisons; results stay byte-identical.
• Linux CI runs the real-daemon tool-provider tests, and release builds ship Linux debug symbols and Windows PDBs as separate archives.

Security & correctness

• Shell {{ck-secret:<label>}} placeholders resolve through the live vault per request: real host/path checks, one shared 10-minute phone-approval deadline, last-waiter cancellation, per-hop fetch authorization, and fail-closed standalone use.
• Shell command logs and issue reports mask inline passwords named PW/PASS and secret-shaped assignments; Linux agent shells raise their OOM kill priority to protect AFT (#750).
• Shared temporary folders no longer start watchers, indexing, or language-server discovery; index builds skip unreadable folders and disclose the gaps instead of failing (#1428); durable writes use the strongest sync a mount supports, so macOS mounts without full-sync fall back to fsync and count that in health.
• Rust diagnostics handle literal concat! includes and local fixture macros (#1425); read(pr://N) shows review-thread IDs and states; PTY tasks with lost exit status report unknown instead of a kill reason.
• OpenCode 2 Code Mode can call AFT's read-only tools through a seven-tool allowlist (#1004).
• AFT syncs signed GitHub routing manifests from the vault and reports the gh shim's activation verdict in daemon health; self-diagnosis uses per-part freshness windows and ignores planned embedding pauses so large heaps and trimmed reports do not produce spurious findings.
• Worker PTY launches hand back the task id immediately, and test shell wait loops are bounded with deadline guards so polling processes stop when the watched directory disappears.