Every invocation SHA-256s the entire bundled runtime tree (23,739 files) — --version takes ~12 minutes

Description

Every command — including --version and --help — hashes all 23,739 files of the bundled runtime tree before doing anything.

Environment

• OS: Windows 11 Pro (build 26200), x64 (also affects macOS/Linux)
• Feynman: current main (dfdcb7c)

Steps to reproduce

1. Install Feynman.
2. Run feynman --version and wait.

Actual behavior

--version takes 12 min 16 s; doctor 13 min 18 s. With AV exclusions: 16.7 s.

Root cause

collectRuntimeTreeEntries (scripts/lib/runtime-workspace-integrity.mjs:276, hashing at :303) SHA-256s the whole tree. It is reached unconditionally because bin/feynman.js imports the patcher before dispatch. Call path: ensurePackageWorkspace() (patch-embedded-pi.mjs:596) → workspaceMatchesRuntime() (:398) → runtimeWorkspaceMatches() (runtime-workspace-restore.mjs:204).

This is a cross-platform defect — macOS and Linux users pay it too. AV is roughly a 44× multiplier on the hashing, not the cause. (Not a workaround recommendation; an AV exclusion is not a fix and is a security downgrade.)

Already ruled out

• Completion marker .runtime-workspace.complete.json exists and is valid.
• Workspace mtime unchanged since install — nothing is re-extracted.
• patch-embedded-pi.mjs reads the app-level settings.json (6 packages), not the user's (7 after installing memory) — a user-installed package does not invalidate the match.
• No opt-out env var.

Expected behavior

Starting the CLI should not hash the entire runtime tree on every invocation.

Proposed directions (asking for maintainer direction)

1. Skip workspace verification for --version / --help.
2. Cache the result keyed on a cheap signature (mtime/size). This trades a strict guarantee for a heuristic one — flagging that trade explicitly.
3. Verify lazily, on package load.
4. Parallelize hashing. Helps, but does not fix the O(whole tree) design.

Impact

The CLI is effectively unusable on a normal Windows machine; severe startup latency on all platforms.

Per CONTRIBUTING.md, larger changes should start with a discussion — which tradeoff would you prefer?