…it verification

- Add src/lib/dev-script.ts: auto-detects dev command from package.json
  (dev > develop > serve > start), manage.py, app.py, main.py, go.mod,
  docker-compose.yml/compose.yml
- Update sentry local run: when no command args provided, auto-detect
  from the project. Add --verify flag (wait for first SDK event, then
  exit) and --timeout flag (kill child after N seconds)
- Add src/lib/init/verify-setup.ts: after successful sentry init, run
  the detected dev command with --verify to confirm SDK sends events.
  On failure, capture a Sentry event with diagnostic context.
- Wire verify-setup into wizard-runner.ts handleFinalResult()
- 21 tests across 3 files (dev-script unit + property, run command)

Tests were using /tmp/opencode which only exists in the local dev
environment. CI runners don't have this directory, causing mkdtemp
to fail. Switch to TEST_TMP_DIR from test/constants.ts which uses
os.tmpdir() and is worker-scoped for parallel test isolation.

…p scripts with env vars

- Store and clearTimeout after Promise.race resolves in runWithVerify
  and verifySetup to prevent holding the event loop alive
- Add SIGINT/SIGTERM forwarding in runWithVerify so Ctrl-C kills the
  child instead of orphaning it
- Detect shell features (env-var prefixes, pipes, operators) in
  package.json scripts and run them via sh -c instead of naive
  whitespace splitting

- Register SIGINT/SIGTERM handlers in verifySetup so Ctrl-C during
  post-init verification kills the child instead of orphaning it
- Await child.exited after SIGTERM in both verifySetup and
  runWithVerify (envelope/timeout branches) so the child releases
  its port before the function returns

- Always add a timeout racer in runWithVerify — defaults to 30s when
  no explicit --timeout is given, preventing indefinite hangs
- Redact KEY=VALUE env-var assignments in the detectedCommand
  telemetry field to avoid leaking secrets from package.json scripts

Use named handler references and removeListener after the race
settles so SIGINT/SIGTERM aren't swallowed during teardown.

Prevents indefinite hangs when the dev server doesn't respond to
SIGTERM. Extracted gracefulKill helper in run.ts; inlined the same
pattern in verify-setup.ts.

- Replace 5_000 with 5000 to satisfy biome useNumericSeparators rule
- Skip all-asterisk inputs in maskToken identity test (masking '*' correctly returns '*')

Store and clearTimeout the SIGKILL grace timer so it doesn't hold
the event loop alive for 5s after a cooperative child exit.

…n env redaction

- Add $ and lowercase letters to SHELL_FEATURES_RE so scripts with
  variable references or mixed-case env assignments route through sh -c
- Wrap gracefulKill's initial SIGTERM in try/catch so an already-exited
  child doesn't skip shutdownServer
- Broaden telemetry redaction regex to match mixed-case env var names

- Clear the watchChildOutput timer when settle() is called from any
  path (fatal error, close event), preventing a 15s stall on exit.

- Broaden ENV_VAR_RE to KEY_VALUE_RE to also catch --flag=value CLI
  arguments (e.g. --api-key=secret) in telemetry redaction.

- Fix URI_USERINFO_RE to handle empty-username URIs like
  redis://:password@host by allowing zero chars before the colon.

- Reuse scrubOutputLine() for detectedCommand telemetry field instead
  of a separate inline regex.

- Add exitCode check before awaiting close after SIGKILL in
  gracefulKill() to prevent indefinite hang if the close event
  fires between the kill call and listener attachment.

- Scrub the error line shown to the user via ui.log.warn with
  scrubOutputLine() to redact credentials that may appear in
  startup errors (e.g. database connection strings in CI logs).

- cleanupChild now awaits the close event after SIGKILL so
  child.exitCode is populated before the crash detection check
  in verifySetup. Without this, a force-killed process would have
  exitCode=null, bypassing the started→exited correction.

- Fix biome formatting (single-line if condition).

- Trim package.json script value before testing against
  SHELL_FEATURES_RE so leading whitespace doesn't prevent detection
  of env-var assignments (e.g. '  NODE_OPTIONS=... tsx dev').

- Remove unused biome-ignore suppression for useMaxParams in
  verify-setup.ts (reportOutcome now takes 2 params via ctx object).

- Remove unused biome-ignore suppression for noControlCharactersInRegex
  in local.ts (biome no longer flags this regex).

- Fix import sort order in wizard-runner.ts after adding logger.

Change ^[A-Za-z_]+= to ^[A-Za-z_]\w*= so scripts like
E2E_BASE_URL=... or API_V2_KEY=... are correctly detected as
needing shell execution instead of being whitespace-split.

Extend the post-race exit code correction to also cover the 'silent'
outcome. A child that crashes immediately with no output would resolve
as 'silent' (from watchChildOutput's close handler) instead of
'exited'. Now both 'started' and 'silent' are corrected to 'exited'
when preCleanupExitCode is non-zero.