feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening

T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both
PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists.
Fixes (1 MED + 3 LOW, all closed):
- WebTermUITests: the single scripted happy path (manual-entry pair → list → attach →
  KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side
  behavior==allow assertion). Green twice locally (fresh + already-paired branches).
- ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg
  (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO
  from app-tests leg (unsigned hosts get -34018 from the real keychain — measured)
- URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes)
- TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only)
Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/
untouched; P0 complete (19/19 tasks)

ios/App/WebTerm/Components/GateBanner.swift

@@ -71,6 +71,7 @@ struct GateBanner: View {
         Button(spec.label) {
             onDecide(spec.affordance, gate.epoch) // epoch of the RENDERED gate
         }
+        .accessibilityIdentifier("gate.decision.\(spec.affordance)")
         .buttonStyle(.borderedProminent)
         .controlSize(.small)
         .tint(tint(for: spec.affordance))

ios/App/WebTerm/Screens/PairingScreen.swift

@@ -60,9 +60,11 @@ struct PairingScreen: View {
                     .keyboardType(.URL)
                     .textInputAutocapitalization(.never)
                     .autocorrectionDisabled()
+                    .accessibilityIdentifier("pairing.urlField")
                 Button(ScreenCopy.manualSubmit) {
                     viewModel.submitManualURL(manualURLText)
                 }
+                .accessibilityIdentifier("pairing.submitButton")
             }
             if let rejection = viewModel.inputRejection {
                 Section {
@@ -155,6 +157,7 @@ private struct ConfirmHostView: View {
                 Button(ScreenCopy.connect) {
                     Task { await viewModel.confirmConnect() }
                 }
+                .accessibilityIdentifier("pairing.confirmButton")
                 Button(ScreenCopy.cancel, role: .cancel) {
                     viewModel.cancel()
                 }

ios/App/WebTerm/Screens/SessionListScreen.swift

@@ -55,6 +55,7 @@ struct SessionListScreen: View {
             } label: {
                 Label(ScreenCopy.newSession, systemImage: "plus.circle.fill")
             }
+            .accessibilityIdentifier("sessions.newButton")
             ForEach(viewModel.rows) { row in
                 Button {
                     viewModel.openSession(id: row.id)
@@ -100,6 +101,7 @@ struct SessionListScreen: View {
         } actions: {
             Button(ScreenCopy.newSession) { viewModel.requestNewSession() }
                 .buttonStyle(.borderedProminent)
+                .accessibilityIdentifier("sessions.newButton")
         }
     }
 
@@ -131,6 +133,7 @@ struct SessionListScreen: View {
                     systemImage: "desktopcomputer"
                 )
             }
+            .accessibilityIdentifier("sessions.hostMenu")
         }
     }
 }

ios/App/WebTerm/Wiring/URLSessionHTTPTransport.swift

@@ -10,7 +10,12 @@ import WireProtocol
 struct URLSessionHTTPTransport: HTTPTransport {
     private let session: URLSession
 
-    init(session: URLSession = .shared) {
+    /// Default is EPHEMERAL, not `.shared` (T-iOS-19 finding): RO GET bodies
+    /// include `/live-sessions/:id/preview` — raw terminal ring-buffer bytes
+    /// that may contain printed secrets — and `.shared`'s default URLCache
+    /// writes responses to disk. Ephemeral keeps them memory-only, matching
+    /// the WS transport and the privacy-shade posture.
+    init(session: URLSession = URLSession(configuration: .ephemeral)) {
         self.session = session
     }