Is there any internal protection in the chip to survive unintentional short of RF /Antenna port to ground?
(Both in case RF is enabled and transmitting and in case RF is disabled)

Absolutely- this was just a proof of concept to validate the failure mode. There is an RC on the board it's just not connected to this pin due to module soldering issue.
Which brings me to- any guidance on what the datasheet calls "proper amount of paste" if using center pads?
Stencil thickness ...

Update, upon shield removal I could confirm power was present, but Enable pin was floating. Connected it to nearby power pin and the part booted.

Good point re shield! We tried Xray so far but with shield walls it's hard to tell.
As far as leakage into GPIO, can we assume they have typical ESD steering diodes to the rail? So ifI put supply voltage on one of them via small resistor I should see something change /micro boot?

Same question - any availability of IBIS models?

Working with a batch of newly build custom boards here and while most work, I have some population with no signs of processor life.
Checked so far:
Supply rail looks ok
No console output

Nothing changes if I pulse RST
Input current very low (700uA or so vs 13-16mA on working boards) and ...

Interesting, we have nothing connected to pin26/GPIO26. For now we got it working by removing encryption, but still not clear why the same scripts worked on dev board. Would the presence/absence of PSRAM do that? The exact module PN on our board is ESP32-S3-MINI-1-N8, but I have no way of knowing ...

We have a custom design using ESP32-S3-Mini-1 that we flash using ESP IDF tools via ESP Prog/UART

Flashing goes through just fine but on boot all we get after reset is "Invalid Header" scrolling through on UART.
The same programming script and binaries, when flashed to an ESP32-S3-DEVKITM boots and ...