fix(ios): synthesize hidden-keyboard text through responder

[thymikee]

Summary

Route bare iOS type after a tapped input with a hidden software keyboard through the runner's process-targeted first-responder synthesis path.

This avoids XCTest's flaky XCUIElement.typeText behavior that could deliver only the first character. Tap-witness provenance is now explicit, the regression test pins the synthesized route, and an unavailable synthesis bridge returns a typed error instead of falling back to the unreliable path.

Document TEXT_INPUT_SYNTHESIS_UNAVAILABLE and its “show the software keyboard, then retry” recovery in the command reference. Generated help/metadata and skills are unchanged because they do not own error-specific recovery guidance.

Scope: five iOS runner files and one command-reference file; no expansion beyond iOS text entry.

Validation

• iPhone 17 Pro simulator, iOS 26.2: testBareTypeUsesTappedInputWhenSoftwareKeyboardIsHidden passed with all 17 characters and synthesized-first-responder
• Same simulator: testBareDelayedTypeFailsWhenTappedInputDisappearsMidCommand passed
• Same simulator: route-policy and private-synthesis status tests passed
• AGENT_DEVICE_XCUITEST_INCLUDE_UNIT_TESTS=1 pnpm build:xcuitest:ios
• pnpm check:affected --run

[thymikee]

Reviewed exact head c172c7c93. The runtime change is sound: the one-shot, bundle/PID-bound tap witness selects the hidden-keyboard bare-type route; synthesis is process-targeted; unavailable synthesis fails closed; and the disappearing-target test prevents silent mid-command success. The exact-head iPhone 17 Pro evidence exercises the production route and observes all 17 characters.

One readiness finding:

• P2 — document the new user-facing failure contract. This PR adds stable error TEXT_INPUT_SYNTHESIS_UNAVAILABLE with recovery semantics, but the body says docs are unchanged because there is no command-surface change. website/docs/docs/commands.md already documents the sibling TEXT_INPUT_NOT_FOCUSED outcome for type; add the new error and its “show the software keyboard, then retry” recovery there (and update generated help/metadata only if that surface owns the same guidance). This is observable command behavior, not purely internal routing.

No further code finding or device-evidence gap. The branch is mergeable; required CI lanes have not appeared yet beyond queued CodeQL, but pending CI is separate from this documentation blocker.

[thymikee]

Re-reviewed at 48eded2ce. The missing user-facing recovery guidance for TEXT_INPUT_SYNTHESIS_UNAVAILABLE is now documented in the command reference, and the PR body correctly identifies that generated help/metadata do not own error-specific recovery guidance. Runtime diff and device evidence are unchanged; pnpm check:affected --run passed. No remaining code findings. Mergeable; CodeQL is queued with no confirmed failure.