test(ios): close T-iOS-32's end-to-end half — real worktree lifecycle against a real server

T-iOS-32's acceptance is "builder 测试 + 端到端一次". The builder half was green,
but grep for projects/worktree across the whole test tree returned nothing — no
test had ever created or removed a real git worktree against a real server.

Six tests on a throwaway git fixture: create/remove/prune verified against both
the filesystem and git's own `worktree list --porcelain` + .git/worktrees/, and
asserting the values the SERVER derives rather than echoing our input (branch
feature/e2e-worktree becomes directory feature-e2e-worktree; the raw branch name
must never appear in the path). Includes a differential leg for the guarded-route
rule — the same request without Origin is 403 with zero side effects, and with it
is 200 — which needs raw URLSession, since APIClient structurally cannot emit an
Origin-less guarded request.

GET /sessions gets its own HOME-isolated server: history.ts reads
os.homedir()/.claude/projects, so against the shared harness the assertions would
land on the developer's real Claude history, and in CI the directory is absent so
it degrades to [] and proves nothing.

Integration tests 26 -> 32, independently re-run.

ios/IntegrationTests/APIClientTokenPolicyProbe.swift

@@ -0,0 +1,25 @@
+//
+// APIClientTokenPolicyProbe.swift — F3：APIClient 侧令牌策略的取值窗口
+//
+// 为什么要单独一个文件：`APIClient` 既是**模块名**又是模块里的**结构体名**，
+// 于是 `APIClient.AuthCookie` 恒被解析成"结构体 APIClient 的嵌套类型"（不存在），
+// 无法在同时 import 了 SessionCore 的文件里限定到模块级符号；而不限定的
+// `AuthCookie` 又会和 `SessionCore.AuthCookie` 撞名。
+//
+// 解法：本文件**只** import APIClient，此处的裸 `AuthCookie` / `AccessTokenRule`
+// 唯一地解析到 APIClient 的那两个 internal 类型，再以带前缀的名字转出去。
+// TokenPolicyDriftTests 用这个窗口，SessionCore 侧则直接 `SessionCore.AuthCookie`。
+
+@testable import APIClient
+
+enum APIClientTokenPolicy {
+    static var cookieName: String { AuthCookie.name }
+
+    static func headerValue(for token: String) -> String {
+        AuthCookie.headerValue(for: token)
+    }
+
+    static func isWellFormed(_ candidate: String) -> Bool {
+        AccessTokenRule.isWellFormed(candidate)
+    }
+}