App-mount race on fast/cold opens: first capture can see an unreadable or empty tree (cross-platform)

Found during #1555's post-merge evidence round (artifacts /private/tmp/ad-p5-evidence-FINAL/retry2/). Two independent sightings of the same shape on DIFFERENT platforms in one session, distinct from #1569's scroll-specific mechanism:

iOS: replay failed at step 2 (react-native dismiss-overlay) with "accessibility tree is unreadable" on a lightly-loaded host (~4.0), immediately after a fast session-reused open (postOpenSettleDurationMs:300). Artifacts: retry2/leg1-ios-run1-retry.
Android: the FIRST replay of a freshly-recorded script diverged at its first click with a fully empty snapshot (refs:[]) immediately after a cold open --relaunch; an immediate retry went green. Artifacts: retry2/leg3-extended (item b, first attempt).

Both look like the app not yet mounted/AX-registered when the first post-open capture lands — the open-settle window is closing before the app's tree is actually readable. Suggested investigation: what does post-open settle currently wait on per platform, and should the first capture after open carry a readable/non-empty-tree precondition with a bounded retry (attempt-bound per the #1569 lesson, not wall-clock)?

Related: #1569 (distinct mechanism, same corpus), the #1105 capture-wedge lineage (iOS), #1254/#1259 (Android a11y-cache freshness — the helper clears cache per capture, so the Android sighting is likely mount-timing, not cache).

Generated by Claude Code

Fresh CI evidence of this race, third sighting today on the iOS Smoke gate (fixture E2E, wait text "Agent Device Tester" right after app install+launch):

wait timed out for text: Agent Device Tester
reason: wait_capture_stalled, captureStalled: true, readableCaptures: 0, waitedMs: 26269
AGENT_DEVICE_RUNNER_PRIVATE_AX_SNAPSHOT_FAILED=Could not match active AX application for XCTest application

Signature: during app boot the XCTest tree captures come back truncated/unreadable and private-AX fails instantly because the app process has not yet registered with the AX server (activeApplications has no matching pid) — so wait burns its whole budget with zero readable captures. Greens on re-roll every time (runs 92594691996 → green, 92597697434 → red → re-rolled), which is exactly the launch-window race this issue describes. The Could not match active AX application marker is a reliable needle for finding occurrences in CI logs.

iOS half: #2838 (merged) makes open on a local Simulator join the in-flight app discovery before observing the launch. So the first capture after a cold open --relaunch no longer pays for discovery, AX-bridge preparation and the first bridge connection inside a wait poll. That was the wait_capture_stalled / readableCaptures: 0 signature, 15 CI failures from 09-14 to 09-23. The Android sighting and the general "first capture must be readable" precondition are not addressed, so this stays open.

fix(android): bound and type the launch observation of an app open