test(ios): ClientTLS coverage 55.76% -> 89.49%, gate it, fix the three dead CI legs

ClientTLS was the most security-sensitive package in the tree and the least
covered, and it was not in the coverage gate at all (the gate's 4-package set
predates it). 48 -> 84 tests against the real macOS keychain, serialized with a
custom Testing trait after a @globalActor proved insufficient (actors yield at
await, so cross-await critical sections got interleaved by other cases' cleanup).

CI: the app/ipad/ios17 legs ran a bundle containing LiveServerSmokeTests, which
spawns tsx, with no npm ci -- a hard failure, not a skip, on a bare checkout.
Adds the missing iPad UI-test leg, and makes a missing iOS 17 runtime fail loudly
instead of silently reporting green.

ios/IntegrationTests/scripts/coverage-gate.sh

@@ -5,6 +5,12 @@
 # Usage:   coverage-gate.sh <PackageName>          # e.g. coverage-gate.sh WireProtocol
 # Env:     COVERAGE_THRESHOLD=<percent>            # default 80 (red/green demo knob)
 #
+# GATED PACKAGES (kept in sync with .github/workflows/ios.yml's package-tests
+# matrix): WireProtocol, SessionCore, HostRegistry, APIClient — the four of plan
+# §9 — plus ClientTLS, added by B4 (it holds the mTLS identity/keychain code, the
+# most security-sensitive package in the tree, and was the only ungated one).
+# TestSupport stays ungated: it IS the test doubles.
+#
 # WHY THIS EXISTS (plan §9 flaw, fix assigned to T-iOS-16): the raw §9 command
 #   xcrun llvm-cov export -summary-only ... -ignore-filename-regex '(Tests|TestSupport|\.build)/'
 #   | jq '.data[0].totals.lines.percent >= 80'
@@ -20,7 +26,7 @@
 
 set -euo pipefail
 
-PKG="${1:?usage: coverage-gate.sh <PackageName> (WireProtocol|SessionCore|HostRegistry|APIClient)}"
+PKG="${1:?usage: coverage-gate.sh <PackageName> (WireProtocol|SessionCore|HostRegistry|APIClient|ClientTLS)}"
 THRESHOLD="${COVERAGE_THRESHOLD:-80}"
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"