feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening

T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both
PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists.
Fixes (1 MED + 3 LOW, all closed):
- WebTermUITests: the single scripted happy path (manual-entry pair → list → attach →
  KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side
  behavior==allow assertion). Green twice locally (fresh + already-paired branches).
- ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg
  (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO
  from app-tests leg (unsigned hosts get -34018 from the real keychain — measured)
- URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes)
- TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only)
Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/
untouched; P0 complete (19/19 tasks)

ios/App/WebTerm/Wiring/URLSessionHTTPTransport.swift

@@ -10,7 +10,12 @@ import WireProtocol
 struct URLSessionHTTPTransport: HTTPTransport {
     private let session: URLSession
 
-    init(session: URLSession = .shared) {
+    /// Default is EPHEMERAL, not `.shared` (T-iOS-19 finding): RO GET bodies
+    /// include `/live-sessions/:id/preview` — raw terminal ring-buffer bytes
+    /// that may contain printed secrets — and `.shared`'s default URLCache
+    /// writes responses to disk. Ephemeral keeps them memory-only, matching
+    /// the WS transport and the privacy-shade posture.
+    init(session: URLSession = URLSession(configuration: .ephemeral)) {
         self.session = session
     }