Fail closed for unresolved synthesized coordinate fill on iOS

## Problem

The iOS coordinate `fill` path can use `synthesized-first-responder-replacement` when the requested coordinate does not resolve to a concrete text-entry element, a refresh point exists, and the XCTest channel is penalized. In that state, replacement is dispatched through the application-level first responder without concrete element identity or post-write verification.

If focus still belongs to a previous field, an unresolved coordinate fill can therefore replace text in the wrong input while returning a completed result with `verified: nil`. This behavior predates #1700; it is separate from the bare-`type` witness fix merged there. It is also distinct from #1718, which tracks parent-owned touch-point parity for direct selectors and Maestro.

Relevant seams:

- `RunnerTests+SynthesizedTextEntry.swift`: `shouldUseSynthesizedFirstResponderReplacement` and `runSynthesizedReplacementRoute`
- `RunnerTests+TextEntry.swift`: coordinate target resolution and refresh-point fallback
- `src/platforms/apple/interactions.ts`: coordinate `fill` dispatches replacement mode

## Closure

- Fail closed when coordinate fill cannot bind synthesized replacement to the intended text-entry target, or introduce a concrete target/commit signal that provides equivalent safety.
- Add a red/green iOS regression proving an unresolved coordinate fill cannot mutate a previously focused field.
- Preserve the penalized-channel replacement path for a concretely resolved coordinate target.
- Report a structured actionable failure instead of an unverified success when safe replacement cannot be established.
- Update the interaction guarantee classification and contract coverage if the fix changes a declared dispatch-path guarantee.