feat(ios): W5 acceptance + finding fixes — XCUITest happy path, CI legs, privacy/device-family hardening

T-iOS-18 (F-iOS-1..13 walkthrough) + T-iOS-19 (security audit vs built artifacts): both
PASS_WITH_FINDINGS, 0 CRITICAL/HIGH; real-device items DEFERRED with manual checklists.
Fixes (1 MED + 3 LOW, all closed):
- WebTermUITests: the single scripted happy path (manual-entry pair → list → attach →
  KeyBar ^L → injected held gate via POST /hook/permission → tap Approve → server-side
  behavior==allow assertion). Green twice locally (fresh + already-paired branches).
- ios.yml: ui-test leg (server boot + TEST_RUNNER_ env as PROCESS env) + iOS17-floor leg
  (loud-skip if runtime absent, hard-fail if present and red); dropped CODE_SIGNING_ALLOWED=NO
  from app-tests leg (unsigned hosts get -34018 from the real keychain — measured)
- URLSessionHTTPTransport defaults to .ephemeral (no disk cache of preview terminal bytes)
- TARGETED_DEVICE_FAMILY moved to target level (built plist now UIDeviceFamily [1] only)
Final: 306 automated checks green (214 pkg + 76 app + 10 integration + XCUITest); server src/
untouched; P0 complete (19/19 tasks)

ios/project.yml

@@ -54,6 +54,10 @@ targets:
     settings:
       base:
         PRODUCT_BUNDLE_IDENTIFIER: com.yaojia.webterm
+        # Target-level on purpose (T-iOS-19 finding): XcodeGen's target platform
+        # default ("1,2") overrides a project-level value, shipping an
+        # installable-but-untested iPad layout. Target-level wins.
+        TARGETED_DEVICE_FAMILY: "1"
     info:
       path: App/WebTerm/Resources/Info.plist
       properties:
@@ -104,9 +108,26 @@ targets:
     settings:
       base:
         GENERATE_INFOPLIST_FILE: true
+        TARGETED_DEVICE_FAMILY: "1"
         TEST_HOST: "$(BUILT_PRODUCTS_DIR)/WebTerm.app/$(BUNDLE_EXECUTABLE_FOLDER_PATH)/WebTerm"
         BUNDLE_LOADER: "$(TEST_HOST)"
 
+  # XCUITest — exactly ONE scripted happy path per plan §9 (T-iOS-18 finding):
+  # pair via manual entry against a live loopback server → attach → type →
+  # approve a held gate. Kept deliberately minimal (fragile-surface rule).
+  WebTermUITests:
+    type: bundle.ui-testing
+    platform: iOS
+    sources:
+      - App/WebTermUITests
+    dependencies:
+      - target: WebTerm
+    settings:
+      base:
+        GENERATE_INFOPLIST_FILE: true
+        TARGETED_DEVICE_FAMILY: "1"
+        TEST_TARGET_NAME: WebTerm
+
 schemes:
   WebTerm:
     build:
@@ -119,3 +140,14 @@ schemes:
       config: Debug
       targets:
         - WebTermTests
+  # Separate scheme so the slow UI pass never gates the fast unit loop; CI
+  # runs it as its own leg (see .github/workflows/ios.yml).
+  WebTermUITests:
+    build:
+      targets:
+        WebTerm: all
+        WebTermUITests: [test]
+    test:
+      config: Debug
+      targets:
+        - WebTermUITests