feat: add native iOS review journey

[jedwards27]

Summary

• add an isolated iOS Simulator runner that erases/boots a selected runtime, drives a real Flutter integration journey, records the full simulator display, captures logs/screenshots, and writes SHA/dirty/cleanup receipts
• cover pairing-code reveal, edit, and hide through stable semantic widget keys
• preserve production badge-permission behavior while suppressing the unautomatable SpringBoard prompt only for native-review child processes
• add fail-closed runner tests for device/runtime selection, recorder finalization/timeouts, failure receipts, and cleanup

Stack

Stacked on #5968 (feat/native-review-journeys) so the iOS layer can be reviewed independently.

Validation

At clean HEAD 61410c429fc67bd31c105dfbf1b7f68ed11b18d4:

• pre-push hooks passed: branch skew, Desktop check/typecheck/test, mobile tests, Rust tests, and Tauri checks
• mobile analyze: no issues
• full mobile suite: 1,417 passed
• native-review Python suite: 24/24 passed
• two consecutive clean exact-SHA iPhone 17 Pro / iOS 26.5 journeys passed with visible Buzz screenshots, finalized H.264 MP4s, and shutdown/erase cleanup:
  • test-results/native-review/61410c429fc6/ios_pairing/ios-20260815T100106-f971e4/receipt.json (31.625s video)
  • test-results/native-review/61410c429fc6/ios_pairing/ios-20260815T100219-ddcdaa/receipt.json (30.310s video)
• deliberate missing pairing-toggle mutation failed with exact Flutter finder/stack diagnostics while still finalizing a 28.3s MP4, capturing the visible Buzz screen, writing a failed receipt, and passing simulator cleanup

Evidence semantics

The runner records the selected runtime and UDID, source SHA and dirty status, Flutter stdout/stderr, final screenshot, MP4, failure cause, and cleanup errors. A journey or cleanup failure returns nonzero. Native evidence is intentionally local because recordings are large and machine-specific.

[themiguelamador]

Blocking findings:

1. The documented harness tests and desktop runner import PyYAML without installing or pinning it, so they fail from a clean checkout after Hermit activation.
2. The AVAssetWriter loop leaves its frame clock unchanged during backpressure, making its sleep deadline remain in the past and causing a busy-spin that can perturb native performance results.
3. scroll accepts a locator but posts at the pointer's prior screen position, so the declared target is ignored and the wrong view can scroll.
4. The new iOS receipt does not conform to the checked-in receipt schema: it omits flow/timestamps/isolation/steps/measurements/performance and adds an undeclared device object. Publication and comparison consumers therefore receive incomplete provenance.
5. Journey/performance validation accepts invalid durations, duplicate cohort receipts, booleans, and non-finite values, allowing late crashes or non-independent samples to satisfy the cohort minimum.
6. The harness README still says iOS Simulator is a future phase and omits its owned-device safety contract, despite this PR adding the lane.

Fixed in Complear/buzz@2efeddec8 (branch review/pr-5971-fix): locked uv/PyYAML provisioning, backpressure-safe recording, locator-targeted scrolling, schema-compatible iOS receipts, fail-closed validation with tests, and corrected iOS documentation. Verification: native-review 39/39, Swift release build, wrapper validation, Python/JSON/shell syntax checks. The same stacked mobile/desktop changes were additionally validated on descendant #5972 with 1,417 mobile and 4,954 desktop tests.