feat(ios): W1 leaf packages — ReconnectMachine/PingScheduler, GateState/AwayDigest, HostRegistry, APIClient+pairing probe

T-iOS-5: pure reconnect reducer (1s→30s cap, mirrors terminal-session.ts) + 25s PingScheduler, 16 tests
T-iOS-6: gate epoch tracker (rising-edge semantics, canDecide guard) + AwayDigest reducer, 25 tests
T-iOS-7: HostRegistry with SecItemShim keychain seam, 30 tests, 88.1% own-src coverage
T-iOS-8: APIClient (Origin iff-G invariant) + two-step pairing probe, 45 tests, 98.1% coverage
Contract ruling: probe returns Result<HostEndpoint,_> (Host{id,name} built by pairing VM) —
resolves frozen-contract contradiction reported via BLOCKED protocol; adds Tunables.pairingProbeTimeout(10s)
Verified: 178 tests green across 5 packages; coverage gates pass; zero Owns violations

ios/Packages/HostRegistry/Tests/HostRegistryTests/TestFixtures.swift

@@ -0,0 +1,28 @@
+import Foundation
+import WireProtocol
+import HostRegistry
+
+/// On macOS `Foundation.Host` (NSHost) shadows the package type in test
+/// files that import Foundation — pin resolution for the whole test target.
+typealias Host = HostRegistry.Host
+
+/// Shared fixtures for HostRegistryTests. Pure helpers only — no state.
+enum Fixtures {
+    /// Builds a valid Host; traps loudly if the fixture URL is malformed
+    /// (a broken fixture must fail the suite, not silently skip assertions).
+    static func makeHost(
+        name: String = "mac-studio",
+        urlString: String = "http://192.168.1.5:3000",
+        id: UUID = UUID()
+    ) -> Host {
+        guard let url = URL(string: urlString), let endpoint = HostEndpoint(baseURL: url) else {
+            fatalError("test fixture URL invalid: \(urlString)")
+        }
+        return Host(id: id, name: name, endpoint: endpoint)
+    }
+
+    /// Unique UserDefaults suite name per test — isolates parallel tests.
+    static func makeSuiteName() -> String {
+        "HostRegistryTests." + UUID().uuidString
+    }
+}