chore: sync with upstream pingdotgg/t3code main

[yordis]

• Upstream now reads viewer access once, off the pull request detail it already fetches, so the fork's separate permission read has no caller left. The fork's administrator bit is what the merge-bypass affordance actually depends on, so it moves onto the shape upstream kept rather than being carried alongside a read nothing calls.
• Two ledger entries are gone because upstream shipped their behavior: server log records reaching a collector, and a browser trace staying attached to the server trace that started it. Keeping an entry for something upstream now owns would claim a divergence that no longer exists.
• The part of the logs entry upstream did not take, per-signal configuration for log records and their own batching knobs, folds into the entry about honoring the standard OpenTelemetry variables, which is where the rest of that surface is already described.
• The local file tracer no longer also receives log records once OTLP log export is on. Upstream treats the double export as the documented tradeoff, and disagreeing would mean maintaining a second answer to a question upstream has already answered.
• The lockfile is regenerated rather than hand merged. The fork carries a dependency patch upstream does not, and its integrity hash is derived from the patch contents, so only a real install recomputes it correctly.

[cursor]

PR Summary

Low Risk
Mostly agent docs, review path filters, and vendored .repos content; relay workflow changes are limited to deploy flags and how tracing config is read in CI.

Overview
Agent verification now routes through T3’s first-party surfaces instead of external simulator/browser automation. The ios-debugger-agent and ios-simulator-browser skills are removed, along with repo-level XcodeBuildMCP entries in .mcp.json and .codex/config.toml. test-t3-app and test-t3-mobile are shortened to mandate the Browser and Device panels (and AgentDevice for mobile deep links); they explicitly forbid falling back to other automation. pair-client.sh drops simctl/adb platform branches and takes <mobile-origin> plus the Device panel’s agentDevice.command and targetArgs.

Review and vendored reference noise is reduced: CodeRabbit and new .macroscope/ignore.md exclude .repos/** (read-only Effect/Alchemy checkouts). The bulk of the diff refreshes .repos/alchemy-effect (submodule layout, CI, demos, changelog)—not imported by the app.

CI/ops tweaks: relay production deploy uses --no-input and a dedicated client-config env path with a generic success status; release reads relay tracing outputs via npx alchemy state read instead of a deploy read-state step. Thread-transfer reporting accepts thread-transfer-v2 and avoids bogus ceiling/regression math when scenarios differ.

^{Reviewed by Cursor Bugbot for commit 08065b7. Bugbot is set up for automated code reviews on this repo. Configure here.}