Harden and accelerate the mobile ticket flow

[amkdown-max]

Summary

• add monotonic sale-time calibration, snapshot-aware page probing, richer coordinate-cache fingerprints, and local hot-path benchmarks
• make refresh recovery bounded and state-aware, with structural fingerprints, per-round action budgets, and fail-closed handling for unknown pages
• bind formal event, session, price, quantity, attendee, and submit-button actions to fresh exact page evidence
• add canonical physical-device locking and a durable one-shot submit-intent journal to prevent concurrent or duplicate submission
• attribute payment/order results only to the matching current-run click boundary; old unpaid-order or payment pages require manual review
• keep every probe entrypoint observation-only, including prompt-driven probe mode, and update user guidance and regression coverage

Why

The previous mobile path had avoidable serial device round trips and several ambiguous recovery boundaries. A stale coordinate, refresh overlay, reconnect, old payment page, or second process could otherwise be mistaken for safe progress. The changes reduce read-hot latency while making every money-moving transition depend on current page identity and durable single-click state.

User and developer impact

• read-only detail-page probes reuse the already-validated hierarchy and no longer navigate or click
• refresh failures recover sooner when the page structure actually changes, while unchanged faults stop without repeated actions
• formal runs fail closed when event identity, session, price, attendee, quantity, device identity, or result attribution is incomplete
• local configuration, device identifiers, and probe artifacts remain ignored and are not included in this PR

Validation

• .venv/bin/pytest -q: 1714 passed, branch coverage 81.23%
• .venv/bin/python -m compileall -q mobile tests
• bash -n mobile/scripts/start_ticket_grabbing.sh mobile/scripts/run_from_prompt.sh
• git diff --check
• three bounded read-only probes on Android/Damai all returned probe_ready, exit_code=0, and submit_intent=null
• observed app probe times were 0.54 s, 0.50 s, and 0.44 s; the phone remained on the target detail activity

Safety notes

No real order, payment, CAPTCHA bypass, or anti-risk-control bypass was performed. Real submission and peak-sale behavior still require supervised validation; ambiguous post-click state remains locked for manual review rather than automatically retrying.