fix: api/cli/registry bridges + high-value codebase-audit fixes

[Xiddoc]

Summary

Fourth sweep batch — 18 fixes: the api/cli/registry "bridge" issues that span multiple hub files (so they couldn't be parallelized in earlier batches), plus the highest-value findings from the 18-agent codebase audit (filed as #252–#266). One bucket per file-disjoint area, each gate-verified, integrated cleanly.

Bridge issues (span api/cli/registry/settings/frida_download)

• Frida-less adb-only ports config crashes ls/status/doctor/frida with KeyError: 'frida' (redroid backend), taking down the whole fleet listing #158 Frida-less ports: config no longer KeyErrors ls/status/doctor/frida-addr (returns the unsupported sentinel like the vm backend)
• beetroot ls/status re-read+re-parse the global registry and each beetroot.yaml O(N)+ times per command (no per-command snapshot reuse) #230 ls/status reuse a single registry snapshot + memoized port index (fewer instances.json reads / beetroot.yaml parses) (Quality)
• Cross-instance port-collision check runs outside the registry lock (TOCTOU on explicit host: pins; concurrent applies both pass) #183 cross-instance port-collision check moved inside the registry lock (closes a TOCTOU double-bind)
• apply() clobbers a working frida-server with an empty placeholder before re-download, leaving Frida silently disabled when the re-fetch fails on a cache miss #165 apply() no longer clobbers a working frida-server with an empty placeholder before re-download
• frida-server arch defaults to android-x86_64 with no host-arch detection, staging an unrunnable binary on aarch64 redroid host/auto instances #189 frida-server arch auto-detects from the host (aarch64 → android-arm64) (Feature)
• Malformed BEETROOT_*_TIMEOUT env var crashes every beetroot invocation with a raw pydantic traceback at import, bypassing cli.main()'s error boundary #197 a malformed BEETROOT_*_TIMEOUT maps to error:/exit-1 instead of an import-time traceback that bricked even --help

Codebase-audit fixes

• AdbDevice.install_frida hangs forever: backgrounded frida-server inherits adb's captured stdout with no timeout #253 install_frida detaches the daemon's stdio so it can't hang forever
• serial_is_available / _adb_unchecked run adb with no timeout, so a wedged adb-server hangs ls/status/doctor and the auto-install re-probe #256 serial_is_available/_adb_unchecked run adb with a 5s timeout (a wedged adb no longer hangs the fleet listing)
• Warm boot_cache resume re-streams a full SHA-256 over the multi-GB rootfs on every up, eroding the warm-start speedup #254 boot_cache memoizes the rootfs digest on (path,size,mtime) — warm up no longer re-hashes the multi-GB image every start (Quality)
• Local rootfs bake pulls the host-native (wrong-arch) redroid image on non-x86_64 hosts — no --platform pin #258 rootfs bake pins --platform=linux/amd64; Docker static bundle is downloaded and extracted into the trusted guest rootfs with no digest verification #262 verify the Docker static bundle against a pinned sha256 before extract (Security — machinery + tests; the literal default digest is a follow-up)
• console.table() interprets rich markup in cell values, silently corrupting instance paths containing brackets #259 console.table() markup-escapes cells/headers (bracketed paths no longer corrupt/crash the listing)
• No downloader validates bytes-received against Content-Length, so a clean short read silently caches a truncated frida-server / module zip #261 module downloads validate bytes-received vs Content-Length
• snapshot.restore decompresses the entire archive twice (manifest-validation pass + extraction pass) #265 snapshot manifest written first (no double-decompress) + restore decompression-bomb cap (Quality)
• e2e tier-vm-qemu savevm boot-cache is dead: actions/cache stores only vm-overlay.qcow2, never the cache-key sidecar the CLI requires for a warm resume (#49 follow-up) #260 e2e savevm cache stores the cache-key sidecar (the boot-cache was dead in CI without it)
• magisk-config.sh denylist split keeps surrounding whitespace, so a space-padded package name is enrolled verbatim and never hides root #263 denylist loop trims whitespace; Docs GitHub links use /blob/main and /tree/main but the default branch is master (404s) #266 docs main→master links (Quality)

Testing

Full local gate green: ruff, ruff format --check, mypy --strict (src+tests), pytest -p no:randomly at 100% line+branch coverage (1960 passed, 6 docker-daemon skips), shellcheck/shfmt, yamllint, actionlint, zizmor, codespell, deptry, uv lock --check, changelog lint.

🤖 Generated with Claude Code

https://claude.ai/code/session_01P1YsNMpGizhSDDPCBu5cut

---

Generated by Claude Code