#16028 test: pay the Pi fixtures' first exec before timing them

The Pi extension tests no longer lose a race with macOS's first-run check. tests/test_pi_extension_dispatch.py failed three times on fleet minis with FAIL: timeout harness missed a serialized command: ['start second', 'end second'], and tests/test_pi_extension_install.py once with generated Pi extension is not importable. In each case a freshly written fixture's first exec was held past the extension's timer. Each fixture now pays that check before any timed run. This is the Pi part of #15488.

Cause

macOS holds the first exec of every newly written file while syspolicyd assesses it. On this Mac a fresh script's first exec takes about 200 ms, and later ones take 5–20 ms. First execs happening at the same time queue about 185 ms apart, so a few fresh executables anywhere on a loaded mini push one past a second.

• Dispatch, check_timeout_serialization: the extension times each child from spawn and sends SIGTERM at CMUX_PI_HOOK_TIMEOUT_MS=1000. The fake timeout-cmux logs start before it installs its SIGTERM handler. A log of ['start second', 'end second'] with no overlap second therefore means the first child was killed by SIGTERM's default action before its first line ran.
• Install: the real stderr in run 36632828304 was timed out waiting for hooks pi prompt-submit, a 5 s wait. The fresh fake cmux runs for the first time inside that wait.

Failures on the fleet:

• run 36477723258, cmux8s
• run 36632828304, cmuxs-mac-mini-5 (also failed the install test)
• validation run 36713362165, cmux14. That run already had the Hermes (#15768) and Claude wrapper (#15955) priming, and both of those passed. The Pi fixtures were the ones left unprimed.

Change

make_executable in both files adds a guard right after the shebang, in bash, node or Python form, so the fixture exits at once when CMUX_TEST_PRIME_EXEC is set. It then runs the fixture once that way, with only PATH and that key set. This is the pattern #15768 and #15955 use. No timeout, budget or assertion changes.

Verification

The dispatch checks ran under bun on this Mac, against the extension source assembled from the CLI/ strings; nothing was built.

Scenario	Before	After
Timeout check, 1.5 s artificial first-exec delay	3 of 3 fail with the CI message	3 of 3 pass
Timeout check, 10 fresh scripts exec'd at the same time (real queueing, no emulation)	2 of 2 fail with the CI message	2 of 2 pass
All 35 checks, 5.5 s delay on every fixture	13 fail	all pass
Full dispatch file, no delay	pass, 27.3 s	pass, 30.0 s

An artificial first-exec delay of 5.5 s reproduces the install test's exact error, and the fixed file passes under the same delay. The whole install file needs a built CLI, so it wasn't run here.

Coverage. Both files run only in the macOS CLI product tests lane, which this PR skips because it changes only Python tests. The #15488 full-suite validation ran them with this change on cmuxs-mac-mini-5, where both had failed in run 36632828304: tests/test_pi_extension_install.py ok in 22.4s and tests/test_pi_extension_dispatch.py ok in 30.7s, with all 84 lane tests passing (job).

Changelog

• none

🤖 Generated with Claude Code