fix(fleet): preflight pane runtimes before install (#1256)

packages/mosaic/framework/tools/fleet/test-start-agent-session.sh

@@ -484,6 +484,27 @@ assert_missing_pane_binary_rejected() {
 assert_missing_pane_binary_rejected mosaic
 assert_missing_pane_binary_rejected pi
 
+# #1256. Name resolution is not executable reachability. A script can resolve
+# while its /usr/bin/env shebang command is absent from PANE_PATH; reject that
+# before tmux creates the doomed session.
+: > "$TMUX_CALLS"
+HOME_UNEXECUTABLE="$ROOT/unexecutable-shebang"
+write_generated "$HOME_UNEXECUTABLE" "coder-unexecutable"
+rm -f "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
+printf '#!/usr/bin/env mosaic-test-absent-interpreter\n' > \
+  "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
+chmod +x "$HOME_UNEXECUTABLE/.npm-global/bin/mosaic"
+if output=$(MOSAIC_TEST_PANE_PID=$$ run_start "$HOME_UNEXECUTABLE" coder-unexecutable 2>&1); then
+  fail "launcher accepted a resolved mosaic script with an absent shebang command"
+fi
+echo "$output" | grep -qF 'code=unexecutable-binary' || \
+  fail "unexecutable shebang diagnostic missing: $output"
+echo "$output" | grep -qF 'mosaic-test-absent-interpreter' || \
+  fail "unexecutable shebang diagnostic did not name the missing dependency"
+if tr '\0' '\n' < "$TMUX_CALLS" | grep -qF new-session; then
+  fail "launcher created a session after its shebang dependency check failed"
+fi
+
 # #1241. tmux destroys a session when its pane command exits, so no pane PID a
 # second after new-session means the runtime died on startup. This used to be a
 # WARNING about the heartbeat sidecar followed by exit 0 — three layers above it