Gate frontend SDK imports before build-time env validation

General lesson: when a browser SDK constructor rejects missing configuration, validate build-time public variables before eagerly importing the application module that constructs the client. Render an actionable configuration state, and make recovery instructions include the rebuild that re-embeds Vite-style variables. In worktree onboarding, never use an unconditional copy to create .env because the destination may already be a symlink to a sensitive checkout; guard both ordinary files and symlinks before copying.

Applicability: frontend bundles whose environment values are substituted at build time, especially repositories using per-worktree env symlinks. Limits: presence validation distinguishes missing configuration only; it does not establish that a key is valid, RLS permits the operation, or the remote service is available.

Evidence/example — 2026-09-18: invoice-processor PR #463 reproduced a Supabase client constructor failure before React rendered, then added a guarded dynamic import, visible missing-variable guidance, symlink-safe setup steps, rebuild guidance, and entrypoint regression coverage. Five startup/entrypoint tests, TypeScript checking, a production Vite bundle, a service-role access scan, visual preview, and independent critic review supported the scoped result. Source: https://github.com/e3-solutions/invoice-processor/pull/463