feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening

T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both
PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists.
Fixes (1 MED + 3 LOW, all closed):
- WebTermUITests: the single scripted happy path (manual-entry pair → list → attach →
  KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side
  behavior==allow assertion). Green twice locally (fresh + already-paired branches).
- ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg
  (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO
  from app-tests leg (unsigned hosts get -34018 from the real keychain — measured)
- URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes)
- TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only)
Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/
untouched; P0 complete (19/19 tasks)

.github/workflows/ios.yml

@@ -71,10 +71,14 @@ jobs:
       - name: Generate project
         run: cd ios && xcodegen generate
       - name: xcodebuild test (WebTermTests, iPhone 16 simulator)
+        # No CODE_SIGNING_ALLOWED=NO: KeychainHostStoreLiveTests exercises the
+        # real data-protection keychain, which returns -34018 for UNSIGNED test
+        # hosts; simulator ad-hoc signing needs no certificates. (W5-fix
+        # handoff finding, verified locally in the ui-test leg runs.)
         run: |
           xcodebuild -project ios/WebTerm.xcodeproj -scheme WebTerm \
             -destination 'platform=iOS Simulator,name=iPhone 16' \
-            CODE_SIGNING_ALLOWED=NO test
+            test
 
   # Layer 3: contract tests against the real Node server (T-iOS-16 test list).
   # npm ci compiles node-pty (needs the Xcode toolchain — present on the
@@ -92,3 +96,106 @@ jobs:
         run: npm ci
       - name: swift test vs real server (ServerHarness boots tsx src/server.ts)
         run: swift test --package-path ios/IntegrationTests
+
+  # Layer 4 (W5, plan §9): the ONE scripted XCUITest happy path — 配对(手输) →
+  # 列表 → attach → 输入 → gate approve — against a live loopback server. The
+  # runner process reads WEBTERM_SERVER_URL (delivered via xcodebuild's
+  # TEST_RUNNER_ env prefix) and makes its own HTTP assertions against the
+  # server (/live-sessions, /live-sessions/:id/preview, held /hook/permission).
+  ui-test:
+    runs-on: macos-15
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - name: Select Xcode 16.3
+        run: sudo xcode-select -s /Applications/Xcode_16.3.app/Contents/Developer
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      - name: npm ci (builds node-pty native module)
+        run: npm ci
+      - name: Start web-terminal server on loopback
+        run: |
+          PORT=3217 BIND_HOST=127.0.0.1 SHELL_PATH=/bin/bash USE_TMUX=0 \
+            nohup node_modules/.bin/tsx src/server.ts > uitest-server.log 2>&1 &
+          echo $! > uitest-server.pid
+          ready=0
+          for _ in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:3217/live-sessions > /dev/null; then
+              ready=1
+              break
+            fi
+            sleep 1
+          done
+          if [ "$ready" -ne 1 ]; then
+            echo "server did not come up on 127.0.0.1:3217" >&2
+            cat uitest-server.log >&2
+            exit 1
+          fi
+      - name: Install XcodeGen
+        run: brew install xcodegen
+      - name: Generate project
+        run: cd ios && xcodegen generate
+      # The 输入 step taps the KeyBar, which is the terminal's
+      # inputAccessoryView — it only exists while the SOFT keyboard is up.
+      - name: Disable simulator hardware keyboard (KeyBar rides the soft keyboard)
+        run: defaults write com.apple.iphonesimulator ConnectHardwareKeyboard -bool false
+      - name: xcodebuild test (WebTermUITests, iPhone 16 simulator)
+        # TEST_RUNNER_<VAR> must be an ENV VAR of the xcodebuild process (it
+        # strips the prefix and injects <VAR> into the test-runner process);
+        # passing it as a KEY=VALUE argument makes it a build setting, which
+        # never reaches the runner (verified empirically, 2026-07-05).
+        # NO CODE_SIGNING_ALLOWED=NO here: the app must be (ad-hoc) signed or
+        # the data-protection keychain rejects every SecItem call (-34018) and
+        # pairing dies at "保存到本机失败" (verified empirically, run 6).
+        # Simulator builds sign locally without any certificate.
+        env:
+          TEST_RUNNER_WEBTERM_SERVER_URL: http://127.0.0.1:3217
+        run: |
+          xcodebuild -project ios/WebTerm.xcodeproj -scheme WebTermUITests \
+            -destination 'platform=iOS Simulator,name=iPhone 16' test
+      - name: Server log + shutdown
+        if: always()
+        run: |
+          cat uitest-server.log || true
+          kill "$(cat uitest-server.pid)" 2>/dev/null || true
+
+  # Device-matrix floor (plan §9: "iOS 17 最低目标模拟器各一轮"): run the
+  # WebTermTests unit bundle on an iOS 17.x simulator runtime.
+  # CI-ONLY LEG: GitHub macOS runner images ship older Xcode versions whose
+  # iOS 17.x simulator runtime is registered system-wide with CoreSimulator, so
+  # Xcode 16.x can build against it. Local machines are NOT expected to
+  # download the ~8 GB runtime. If the runner image drops the 17.x runtime,
+  # the leg skips WITH A LOUD NOTICE; if the runtime exists, test failures
+  # fail the job (no silent pass).
+  ios17-floor-tests:
+    runs-on: macos-15
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - name: Select Xcode 16.3 (build toolchain)
+        run: sudo xcode-select -s /Applications/Xcode_16.3.app/Contents/Developer
+      - name: Install XcodeGen
+        run: brew install xcodegen
+      - name: Generate project
+        run: cd ios && xcodegen generate
+      - name: Create iOS 17.x simulator (skip-with-notice if runtime absent)
+        id: sim17
+        run: |
+          runtime="$(xcrun simctl list runtimes | grep -Eo 'com\.apple\.CoreSimulator\.SimRuntime\.iOS-17-[0-9]+' | tail -n 1 || true)"
+          if [ -z "$runtime" ]; then
+            echo "::notice title=iOS 17 floor leg skipped::no iOS 17.x simulator runtime on this runner image (image drift) — the deployment-floor round did NOT run"
+            echo "runtime=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          udid="$(xcrun simctl create 'iPhone 15 iOS17' 'iPhone 15' "$runtime")"
+          echo "created $udid with $runtime"
+          echo "runtime=$runtime" >> "$GITHUB_OUTPUT"
+          echo "udid=$udid" >> "$GITHUB_OUTPUT"
+      # No CODE_SIGNING_ALLOWED=NO: KeychainHostStoreLiveTests needs a signed
+      # (ad-hoc, certificate-free on simulator) app host — unsigned = -34018.
+      - name: xcodebuild test (WebTermTests on the iOS 17.x floor)
+        if: steps.sim17.outputs.runtime != ''
+        run: |
+          xcodebuild -project ios/WebTerm.xcodeproj -scheme WebTerm \
+            -destination "platform=iOS Simulator,id=${{ steps.sim17.outputs.udid }}" test