B4: DESIGN_READY only when the design binary actually starts

DESIGN SETUP (and office-hours' visual exploration) printed DESIGN_READY for
any executable binary, so one SIGKILLed at launch by an invalid macOS code
signature still passed. Launch it under the portable 10-second deadline
(gtimeout, timeout, or perl alarm); otherwise print DESIGN_NOT_AVAILABLE with
the exit code, 'timed out after 10s', or on 137 the code-signature hint and
'Fix: cd <checkout> && ./setup'. A success is cached by inode and mtime under
the state root so Gatekeeper's first-launch scan is paid once.

The probe launches the binary with no arguments (usage, exit 0): the design
CLI has no --version command today.

scripts/resolvers/design.ts

@@ -1115,16 +1115,38 @@ ${slopSection}
 Source: [OpenAI "Designing Delightful Frontends with GPT-5.4"](https://developers.openai.com/blog/designing-delightful-frontends-with-gpt-5-4) (Mar 2026) + gstack design methodology.`;
 }
 
+/**
+ * B4 (#1076, #1254): DESIGN_READY only when the binary actually starts. A
+ * binary that is merely executable can still be SIGKILLed at launch (an
+ * invalid macOS code signature), so launch it (no arguments prints usage and
+ * exits 0) under the portable deadline aside.ts uses. A success is cached by
+ * inode + mtime so Gatekeeper's first-launch scan is paid once.
+ */
+function designReadyProbe(ctx: TemplateContext): string {
+  return `_DS=$("${toShellPath(ctx.paths.skillRoot)}/bin/gstack-paths" --get GSTACK_STATE_ROOT 2>/dev/null); _DC=\${_DS:+$_DS/design-ready}
+_DK="$(ls -diL "$D" 2>/dev/null | awk '{print $(1)}') $( (stat -L -c %Y "$D" || stat -L -f %m "$D") 2>/dev/null) $D"
+_dt() { if command -v gtimeout >/dev/null; then gtimeout 10 "$@"; elif command -v timeout >/dev/null; then timeout 10 "$@"
+elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 10 "$@"; else return 125; fi; }
+_RC=0
+if [ ! -x "$D" ]; then _RC=missing
+elif [ -z "$_DC" ] || [ "$(cat "$_DC" 2>/dev/null)" != "$_DK" ]; then _dt "$D" >/dev/null 2>&1 </dev/null || _RC=$?
+fi
+case "$_RC" in
+  0) echo "DESIGN_READY: $D"; [ -n "$_DC" ] && printf '%s' "$_DK" > "$_DC" 2>/dev/null ;;
+  missing) echo "DESIGN_NOT_AVAILABLE: $D is not installed. Fix: cd \${D%/design/dist/design} && ./setup" ;;
+  124|142) echo "DESIGN_NOT_AVAILABLE: $D timed out after 10s at launch" ;;
+  125) echo "DESIGN_NOT_AVAILABLE: no timeout, gtimeout or perl to bound the $D launch check" ;;
+  137) echo "DESIGN_NOT_AVAILABLE: $D exited 137 (killed at launch; on macOS usually an invalid code signature). Fix: cd \${D%/design/dist/design} && ./setup" ;;
+  *) echo "DESIGN_NOT_AVAILABLE: $D exited $_RC at launch" ;;
+esac`;
+}
+
 export function generateDesignSetup(ctx: TemplateContext): string {
   return `## DESIGN SETUP (run this check BEFORE any design mockup command)
 
 \`\`\`bash
 ${binaryAssignment(ctx, 'design')}
-if [ -x "$D" ]; then
-  echo "DESIGN_READY: $D"
-else
-  echo "DESIGN_NOT_AVAILABLE"
-fi
+${designReadyProbe(ctx)}
 \`\`\`
 
 ${ctx.skillName === 'design-consultation' ? `If \`DESIGN_NOT_AVAILABLE\`: use Phase 5 Path B (HTML preview). Mockups are optional.
@@ -1159,7 +1181,7 @@ export function generateDesignMockup(ctx: TemplateContext): string {
 
 \`\`\`bash
 ${binaryAssignment(ctx, 'design')}
-[ -x "$D" ] && echo "DESIGN_READY" || echo "DESIGN_NOT_AVAILABLE"
+${designReadyProbe(ctx)}
 \`\`\`
 
 **If \`DESIGN_NOT_AVAILABLE\`:** Fall back to the HTML wireframe approach below