feat: rework the log, the launcher and the developer workflow - #533

Optimization(zh-Hant): 贊助卡片改為橫式排版，與右欄其他卡片對齊更好看
Optimization(en-US): the sponsor card now row-aligns with the right column

New(zh-Hant): 更多頁上方卡片重新設計，版本以漸層數字顯示，pre-release 顯示上一版主版本號
New(en-US): the More hero cards go flat, and the version card leads with a gradient major.minor named after the last release

New(zh-Hant): 取得 App 下方新增 測試版 與 合作夥伴 區塊
New(en-US): beta channels and partner tiles now sit under Get the app

New(zh-Hant): 伺服器狀態查詢在離線時會改用上次快取結果
New(en-US): status POSTs cache under their URL and serve offline

New(zh-Hant): 更新日誌的貢獻者改為頭像加名稱的名牌，可點開 GitHub 個人頁
New(en-US): changelog contributors are avatar + name badges that open GitHub

New(zh-Hant): 地震報告圖快取到本機，重複查看不再每次重新下載
New(en-US): the report image now round-trips the ETag cache

New(zh-Hant): 無背景定位支援的平台不再回報麵包屑傾倒錯誤
New(en-US): breadcrumb draining no longer trips on missing plugins

`bool.fromEnvironment` reads only the exact string `true` and answers `false`
to everything else, including the `1` the script passed — so the guard fired on
the very launch that had obeyed it. That is the worst way for a guard to fail:
it punishes the correct behaviour and teaches people to ignore it.

The scripts send `true` now, and the marker is read with
`String.fromEnvironment != ''` so any value counts — the next person to edit
that line will not remember this either.

The colouriser also missed the prefix on a blank line, which Flutter writes as
`flutter:` with no trailing space, so a multi-line message kept it.

Fix(zh-Hant): 更新日誌改為標示真正寫這項變更的人，並附上可點擊的 commit 連結
Fix(en-US): each entry credits who wrote it and links the commit it came from

GitHub squashes a pull request into one commit and sets its author to whoever
pressed the button, demoting everyone who wrote it to a `Co-authored-by:`
trailer. `41a3c1e8 Fix eew (#534)` is authored by the maintainer who merged it
and was written, every commit of it, by somebody else — so 26w34b credited the
wrong person, which is worse than crediting nobody.

A summary carrying `(#N)` now takes its authors from that pull request's own
commits, which is the only place they survive a squash intact; trailers are
merged in for a merge without a number, and the commit's own author is the
fallback. Every entry also links its commit, which for a squash is also the
link to the request.

The gate had made this worse by banning `Co-authored-by:` outright. It was
aimed at a tool crediting itself, and it destroyed the one record of human
attribution a squash leaves behind. It now judges the trailer by who it names.

New(zh-Hant): 除錯資訊頁新增「傾印除錯資訊及日誌」，上傳後複製連結
New(en-US): the debug page can upload the diagnostics and log, and copies the link back

The two halves answer different questions and a report needs both: the
diagnostics say what this build and this device are, the log says what they
just did. Pasting 4000 characters into a chat buries the conversation it is
part of, so they go to a paste and only the link comes back.

The diagnostics are never trimmed — a partial one reads as a complete one and
gets answered as if it were — so the log takes whatever is left of the 4000,
filled from the newest backwards and written oldest first. A line goes in whole
or not at all, because half a line is a lie about what was logged.

The log is in the same shape the terminal uses, so a line pasted from one and a
line pasted from the other are the same line.

Change(zh-Hant): 「傾印除錯資訊及日誌」移到更多 → 除錯資訊下方，並翻譯成十種語言
Change(en-US): the debug dump moved to More, under Debug info, and is now translated

It was a row at the bottom of the Developer page, which is the page a person
reaches only after being told where it is. The dump exists for the people who
have not been told, so it now sits in the menu they are already in, one row
under the page it dumps.

Two screens asking for the diagnostics meant the collection could no longer
live inside one of them, and the layer rules would not let More reach into
Settings for it — so it moved to core/diagnostics, which is where every source
it reads already lives. The Developer page renders from the same report it
uploads, and the redaction list that keeps the push token and the device
identifier out of a paste is now one list instead of two. Two would have
drifted, and the copy that drifts is the one that leaks.

The row is user-facing, so unlike the Developer page it is translated.

New(zh-Hant): 更新日誌每個版本卡片都可以開啟 GitHub 頁面
New(en-US): every changelog card foots a link to its release on GitHub

Fix(zh-Hant): 修正開啟日誌頁動作選單時，終端機與日誌被大量錯誤洗版
Fix(en-US): opening the log screen's Actions sheet no longer floods the log

talker_flutter draws that sheet as a coloured box with bare ListTiles inside
it, which trips a debug assert Flutter raises from ListTile itself — once per
row, into the log the sheet belongs to. Still true on the package's current
release, and the only thing this app controls is the colour it hands the theme.

Said once per session at warning rather than dropped, because the summary
cannot say who raised it: the framework reports from inside the offending
widget's own build, and the widget that wrapped it built in a different
element and is not on the stack. So the line carries the reason and says where
to look if it ever shows up somewhere this explanation does not fit.

Fix(zh-Hant): run.sh 啟動時清掉舊的 DevFS 殘留，並修正清除快取在 debug 會刪掉執行中核心
Fix(en-US): run.sh sweeps stale DevFS dirs, and clear-cache no longer wipes the live kernel

Every `flutter run` builds its DevFS root inside the app sandbox as
`tmp/DPIP<random>/DPIP/`, and three things stop it being cleaned up: the VM
hands the tool back the inner path, so even a clean `q` orphans the outer
directory; `cleanupAfterSignal()` never calls `_cleanupDevFS()`, so Ctrl-C
orphans the dills; and SIGHUP is not handled, so closing the terminal orphans
everything. Nothing sweeps them — 116 directories and 6.8 GB had piled up here,
the oldest 37 days old.

The guard is a process check and not a timestamp. The outer directory's mtime
is frozen at its birth while the dills inside it keep being rewritten, so an
"older than" rule deletes the session running in the next terminal.

The same directory is why the developer page's clear-cache is now gated to
release. Its comment claimed nothing the app owns lives in tmp, which is false
under `flutter run`: the kernel this process is executing from is in there. The
dills grow back, so the mistake looks harmless — the synced asset bundle does
not, because the tool decides what to resend from host state and never learns
the device copy went away, and a shader edit hot-reloads and then reverts.

Not in run.ps1: the leak is `systemTemp` resolving into an iOS sandbox, and
there is no CoreSimulator on Windows.

New(zh-Hant): 伺服器狀態頁新增 Cloudflare 各地區狀態與本機對多活端點的連線判斷表格
New(en-US): the server status page adds Cloudflare regional status and the
  device's own view of each multi-active endpoint
Fix(zh-Hant): 伺服器狀態的本機狀態不再把不存在的服務當成未探測，改以圖例區分
  正常／異常／未探測／不支援，並標明資料來自被動探測
Fix(en-US): the local probe tables now tell unsupported services apart from
  merely-unprobed ones and note that the data is passively observed

Change(zh-Hant): 所有工作流程改用 tool/ 底下的腳本，不再需要手打 mise exec
Change(en-US): every workflow now has a script under tool/; nobody types the toolchain

The rule was already "run tools through mise exec", and the rule was the
problem: it asked every person and every CI step to remember a prefix, and
forgetting it is silent — a shell's PATH is resolved once and mise activate
caches it, so a copied `flutter test` runs whatever SDK the session started
with, and a run against the wrong SDK looks exactly like a run against the
right one. The toolchain is named in one place now, tool/dev/_lib.sh, and
everything else calls it.

tool/ is organised by what a script is for: dev/ daily workflows, check/ the CI
gates, release/ versioning and notes, gen/ generators, internal/ pieces other
scripts call and nobody runs by hand.

CI calls the same scripts a developer calls, so the two cannot drift — that
drift was only ever found by a red PR on a branch that was green. tool/check.sh
runs the whole gate list in one command.

tool/run.sh installs the git hooks when they are missing. Setup used to be a
step in the README, therefore a step people skipped, and skipping it is silent:
build_info.g.dart keeps whatever commit it was committed with, so the debug
page names a build that is not the one running.

tool/check/tooling.sh keeps it true, and it checks commands rather than
mentions — the documentation has to be able to explain the rule it enforces.

Fix(zh-Hant): 修正每次啟動都要重新解析 Swift Package，啟動快約 12 秒
Fix(en-US): the Swift Package graph no longer re-resolves on every launch

A launch runs `-resolvePackageDependencies` twice, and the two runs read
different files: the prefetch has no container argument so it takes the
.xcodeproj scope, and the build passes `-workspace`. Both wrote the same
build/ios/SourcePackages, and the two committed Package.resolved disagreed on
gtm-session-fetcher — 5.3.1 against 5.3.0 — so each step undid the other's
checkout. It could never converge, and nothing rewrites those files, so it
would not have healed on its own.

Measured here, warm cache, one launch pair:

    before  15.80 s, 30 remote updates, 2 checkouts
    after    3.78 s,  0 remote updates, 0 checkouts

Settled on 5.3.0 because that is what is checked out on disk and what the
workspace file already said, so nothing has to be re-fetched. Both are inside
firebase-ios-sdk's declared 3.4.1 ..< 6.0.0. Verified past the resolve: a full
`tool/dev/build.sh ios` links and produces Runner.app.

Change(zh-Hant): 移除 macOS 平台目錄，專案只保留 Android 與 iOS
Change(en-US): removed the macOS platform; the project targets Android and iOS only

`flutter create --platforms=macos .` ran in #525 and left 32 files behind. It
also rewrote .metadata's platform list to root + macos, dropping the android
and ios entries that were there — so the file has been claiming since then that
this is a macOS project, which is what `flutter migrate` reads. Restored to
what it said before.

The analyzer excluded web/, windows/, macos/ and linux/, none of which exist
now, so those go with it.

The web dependency stays, and it is worth writing down why so nobody deletes it
again: maplibre_gl_web is an endorsed federated implementation, so pub pulls it
in whatever we do. Removing the override does not remove the package — it
resolves it from pub.dev instead of the fork, which is a version that does not
match the forked platform interface. Tried, measured in the lockfile, put back.

A commit message here is the changelog and cannot be edited once pushed, so
every mistake in one costs a rebase and a force-push. The information that
would have prevented it was always available — spread across `git status`,
`git rev-list`, the gate, and commit.md — and nobody assembled it at the
moment it mattered.

This prints it in one place, and only prints: it never commits, stages,
fetches, or changes a file. Branch and base and how stale the base is; how far
behind and whether any merge commit is hiding work from the gate; what is
staged, unstaged and untracked, with the build output and the skip-worktree
file called out; which features and areas the change spans; whether a
`Platform:` trailer is needed; whether an ARB was half-translated; the message
shape and the three rules that fail silently; and the gate's verdict on what
is already committed.

It refuses to guess at "one commit, one thing" — nothing can decide whether
two changes are the same thing, and a guessing check would block honest
cross-module work until people learned to route around it. It asks instead.

New(zh-Hant): 版本卡片可以深入檢視本次更新的內容與技術細節
New(en-US): the version card opens this release's highlights and deep dives

Optimization(zh-Hant): 提交前的檢查改成只跑有變動的部分，沒改東西時約 1 秒跑完
Optimization(en-US): the pre-commit checks only re-run what changed, about a second on an unchanged tree

`tool/commit.sh` now reproduces .github/workflows/ci.yml before you commit, so
a branch stops being green locally and red on the runner. That was already
possible and nobody did it, because it cost a minute every time.

So the expensive steps — the analyzer, codegen and the test suite, plus the two
gates that walk every file in lib/ — are keyed on a hash of the files they read.
An unchanged tree costs 1.0 s instead of 49 s. Change one byte in an input and
that step runs; change it back and the proven answer is still there, because
the last eight keys per check are kept rather than only the newest.

Content and not mtime, deliberately: a format pass, a branch switch and a
checkout all move mtimes without changing what the code says, and a cache that
re-runs everything after `git switch` is one people turn off. Untracked files
count — the test somebody just wrote is the most important input and has never
been committed. Only successes are stored; repeating a failure is cheap and
hiding one is not.

The codegen step cannot use CI's `git diff --exit-code`: a developer running
this has uncommitted work by definition, and that would report their own edits
as stale codegen. It regenerates and compares the generated files against
themselves instead, which is the question actually being asked.

Optimization(zh-Hant): 沒有 mise 或用錯 SDK 時直接拒絕執行，不再無聲建置出不一樣的東西
Optimization(en-US): the build now refuses to start off the wrong SDK instead of using it silently

A bare `flutter` was discouraged and is now impossible to do by accident. The
reason it needs enforcement rather than a rule is that it does no visible
damage: it compiles, it runs, the tests pass, and nothing in any line of output
says which SDK produced them. The difference arrives days later as a failure
nobody can reproduce.

`require_mise` checks the three ways to end up with the wrong SDK, only the
first of which announces itself: mise missing, no pin in the checkout, and —
the one that hides — mise resolving flutter to something outside its own
installs, which is what happens when the tool is not really installed and
`mise exec` forwards to a system SDK. Once per process tree, 0.02 s.

The tooling gate now reads every script in tool/ as a script: parses,
executable, has a shebang, and reaches the toolchain only through `pinned`.
`tool/run.sh` runs both before it starts anything, because the launch is the
one moment everybody passes through. Together 0.34 s.

run.ps1 gets the same refusal. It cannot share the bash helper, so it carries
its own check rather than being the one door left open.

The tool/ reorganisation renamed nineteen scripts, and these are the references
that were not in the sweep: comments and prose in lib/, test/, pubspec.yaml,
the two architecture documents and the shader README. A dead path in a comment
is worse than no comment — it sends the next person looking for a file that is
not there, and nothing fails to tell them otherwise.

The generated header in town_label_points.g.dart is here too, and it matches
what tool/gen/town_label_points.dart now writes, so regenerating does not undo
it.

Four comment paragraphs are re-wrapped: the longer paths pushed their lines
past the column limit.

Fix(zh-Hant): 提交與推送前的檢查改由 git hook 強制執行，不再只是印出來
Fix(en-US): the pre-commit checks are now enforced by git hooks instead of only printed

tool/commit.sh printed "behind origin/main — CI refuses to merge a branch that
is not rebased", exited 1, and the commit went in anyway, because nothing wired
it into git. A check nothing enforces is a check, then a habit, then neither.

So it is a hook now, and the severity is split by when the question is actually
being asked. Being behind the base blocks a *merge*, not a commit: demanding a
rebase to record work that is not going anywhere yet would mean rebasing five
times an afternoon, and would teach everybody --no-verify. At commit time it is
a warning; at push time it stops you, along with every CI gate.

pre-commit stands aside during a rebase, a merge, a cherry-pick and a revert.
`git commit` runs it in all of them, with HEAD detached and the branch state
meaningless, and every answer it could give there is about a tree that exists
for the next few seconds.

The gates run in pre-push only. A minute per commit is how a hook gets removed;
a minute per push is the round trip it saves.

`Process.run` inherits the parent environment, so running the suite under
DPIP_NO_CACHE=1 — which is exactly what somebody debugging the cache does —
made every caching assertion test the opposite of what it says. Two of them
failed only in that one situation, which is the situation they exist for.

The variable is now set either way rather than merely omitted.