test(ios): add live system permission-prompt accept/dismiss/recovery journey

## Purpose

Add the one remaining live iOS system-permission journey that fixture-backed simulator coverage cannot replace: native permission-prompt accept, dismiss, and recovery through the public CLI.

#1408 already owns and enforces the fixture-app smoke/full split, stable selectors, cold deep links, keyboard lifecycle, background/foreground resume, modal handling, interrupted system UI, long-list recovery, host-focus preservation, and catalog-level command coverage. Existing Settings/system-app coverage remains additive and must not be removed.

## Required journey

Using the repository fixture app on an iOS simulator:

1. Reset one real OS permission to an undecided state and launch the app path that requests it.
2. Prove `alert get` observes the native system prompt and exposes actionable buttons.
3. Exercise dismissal/denial through the public `alert` command and verify the prompt is gone plus the app/session remain usable.
4. Reset to undecided, trigger the prompt again, accept it through the public command, and verify the granted native permission state plus continued app interaction.
5. Exercise the no-prompt recovery case and require the documented typed outcome rather than a hang, stale modal route, or leaked session/device ownership.

Do not substitute a fixture-owned modal or synthetic alert: the test must cross the SpringBoard/native permission boundary.

## Observable completion

- The journey runs in the appropriate iOS simulator E2E lane against an exact built fixture artifact.
- Assertions cover the native permission state, prompt disappearance, app usability after each branch, and clean session/lease teardown.
- The test is observed red with one relevant production or test invariant deliberately broken before the final green run.
- Focused checks and the affected gate pass; GitHub remains authoritative for the exact-head native lane.

## Non-goals

- Migrating or deleting existing Settings/system-app replays.
- Re-testing fixture behaviors already owned by #1408.
- Broad permission-matrix coverage across every permission type; one representative real native prompt is sufficient for this contract.

Depends on the existing fixture build/install infrastructure from #1408.