fix: clean up #2264 test fixtures and safety gaps

[time-attack]

Summary

This is a cleanup follow-up to #2264.

It removes the oversized iOS expansion that should not have been committed:

• removes the expanded FixtureApp screens and controls;
• removes the committed device screenshot/state fixture;
• removes the oversized physical-device and regeneration test harnesses;
• rolls back the large duplicated accessor-generator rewrite;
• rolls back the tunnel-recovery subsystem and its large test packages;
• restores the small pre-fix: harden test infrastructure and iOS device QA #2264 fixture, generator, daemon, templates, skills, and documentation.

Cleanup PR change: 784 additions, 6,010 deletions — net 5,226 fewer lines than current main.

Final repository state compared with immediately before #2264: 454 additions, 88 deletions across 22 files. Those remaining changes are the small accepted wave fixes plus the safeguards below.

It also fixes the three review blockers:

1. Release/App Store safety: the Objective-C private touch implementation is compiled out in Release. A compact test assembles a temporary app from the real production templates, builds the final Release executable, and proves it contains none of DebugBridgeTouch, _touchesEvent, _AXSSetAutomationEnabled, or IOHIDEventCreateDigitizerEvent.
2. Careful-hook bypass: the hook parses JSON first and fails closed. Escaped quotes, malformed JSON, non-string commands, and multiline safe-prefix tricks cannot hide destructive commands.
3. License: KIF-derived source is correctly attributed as Apache-2.0 with the Square/KIF copyright and license URL.

Verification

• Repository-wide bun test: exit 0.
• Focused Release-app test: passed.
• Careful-hook suite: 40 passed, 0 failed, 109 assertions.
• bun run build: passed.
• Targeted rollback/SQL/generator/daemon/Swift/Release suite: 107 passed, 0 failed, 282 assertions (1 optional device test skipped).
• git diff --check: passed.

No VERSION, package-version, CHANGELOG, ETHOS, or workflow files are changed.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[time-attack]

@time-attack Preserve the focused release check, but restore required daemon recovery, ownership, accessibility, regeneration, documentation, and test coverage.