feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening

T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both
PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists.
Fixes (1 MED + 3 LOW, all closed):
- WebTermUITests: the single scripted happy path (manual-entry pair → list → attach →
  KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side
  behavior==allow assertion). Green twice locally (fresh + already-paired branches).
- ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg
  (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO
  from app-tests leg (unsigned hosts get -34018 from the real keychain — measured)
- URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes)
- TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only)
Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/
untouched; P0 complete (19/19 tasks)

ios/App/WebTerm/Screens/SessionListScreen.swift

@@ -55,6 +55,7 @@ struct SessionListScreen: View {
             } label: {
                 Label(ScreenCopy.newSession, systemImage: "plus.circle.fill")
             }
+            .accessibilityIdentifier("sessions.newButton")
             ForEach(viewModel.rows) { row in
                 Button {
                     viewModel.openSession(id: row.id)
@@ -100,6 +101,7 @@ struct SessionListScreen: View {
         } actions: {
             Button(ScreenCopy.newSession) { viewModel.requestNewSession() }
                 .buttonStyle(.borderedProminent)
+                .accessibilityIdentifier("sessions.newButton")
         }
     }
 
@@ -131,6 +133,7 @@ struct SessionListScreen: View {
                     systemImage: "desktopcomputer"
                 )
             }
+            .accessibilityIdentifier("sessions.hostMenu")
         }
     }
 }