refactor: replace hand-rolled parsers with standard packages

[latekvo]

What & why

Swept the repo for hand-rolled regex/string parsers that reimplement a solved problem, and replaced the genuinely fragile ones with battle-tested packages (or deps already in the tree). Each swap is paired with a regression test for an input the old code got wrong.

Site	Was	Now
adb.ts resolveAvdPath, linux-preflight.ts readMb	per-key anchored regex over AVD .ini / config.ini	ini
workspace-reader.ts extractEnvKeys	split-on-first-= line loop	dotenv (parse)
uninstall.ts readBundledSkillName	^name:(.+)$ capture + outer-quote strip	yaml (already a dep)
mcp-configs.ts escapeRegExp	hand-rolled char-class escape	escape-string-regexp
export.ts xctrace version, session-context.ts RN minor	match(/(\d+)\./) / split(".")[1]	semver coerce (already a dep)
source-resolver.ts parseDebugStack	at fn (file:l:c) regex (required both line+col)	stacktrace-parser

Bugs these fix (covered by new tests)

• ini: a quoted path = "/Users/My Name/.../X.avd" kept its quotes, failed the startsWith("/") guard → AVD unresolved. Inline comments / trailing junk after a sizing value made the anchored regex return null → sizing warning silently lost.
• dotenv: export FOO=bar produced the key "export FOO" (dropped by the identifier filter); a multi-line quoted value leaked its continuation lines (FAKE=...) as phantom keys.
• yaml: a name: value with a trailing # comment was taken verbatim (comment included); odd quoting only had one outer pair stripped.
• stacktrace-parser: a :line-only frame (no column, as Hermes/JSC can emit) became an unusable unknown frame.

Deliberately left alone (not "flaky", or no safe swap)

To avoid churn and regressions, I did not touch:

• uiautomator-parser.ts hand-rolled XML parser — a deliberate, documented choice with a dedicated hardening suite, including a leniency test for malformed dumps (stray </node>). A spec XML parser would reject inputs this is built to recover from.
• ios-profiler/pipeline/xml-parser.ts (xctrace XML) — the most tangled parser, but it has no real .trace fixtures and only thin entity-decode tests. A rewrite can't be proven equivalent without device-generated traces, so swapping it blind risks silently breaking iOS CPU/hang/leak reports. Best done separately with a captured fixture.
• http.ts extractHostname — DNS-rebinding guard; URL.hostname keeps the IPv6 brackets the loopback check compares without, so the "fix" isn't simpler and the path is security-sensitive.
• adb.ts shellQuote — the POSIX single-quote escape is the standard correct form.
• parseAdbDevices, android-screen.ts wm size, detect-app.ts dumpsys — tool-specific CLI-output scraping with no clean package equivalent (and documented edge-case handling).
• workspace-reader.ts extractMetroPort — a best-effort heuristic over JS config; a correct replacement needs an AST parse, out of scope here.
• config-parse.ts Yarn/npm age-gate parsing — a precise, unit-tested domain parser; ms would introduce a bare-number ambiguity.

Verification

• tsc --build clean across the workspace graph.
• Tests: tool-server 1205, installer 264, update-core 31 — all pass (incl. the new regression tests).
• prettier --check clean on all changed files.
• Production esbuild bundle (bundle-tools.cjs) emits a valid tool-server.cjs/mcp-server.mjs with ini/dotenv/stacktrace-parser inlined (node --check OK). (The script's final step errored only on the auth-gated trace-processor.wasm download, unrelated to bundling.)

New runtime deps: ini, dotenv, stacktrace-parser (tool-server), escape-string-regexp (installer) — all small, pure-JS. Lockfile change is purely additive.