iOS TrUAPI container blocks every cross-origin fetch, even after a Remote domain grant

TLDR

A product requests Remote permission for a domain. The host prompts, the user allows, and requestRemotePermission returns granted. The host settings screen shows the domain as allowed. The next fetch to that domain still fails with TypeError: Network access is not allowed.

Cause

The TrUAPI lockdown script js/container/src/index.ts (built into ios/truapi-host as truapi-container.js) allows same-origin fetch only (lines 56-67) and deletes XMLHttpRequest. It never reads the stored Remote grants.

Reproduction

Use 3rd-party-fetch.paseo. It queries a public API endpoint before and after a Remote grant and prints every result.

1. Open 3rd-party-fetch.paseo in a testnet iOS build with "TrUAPI Runtime" ON.
2. Tap "Request permission" and allow the prompt. The log shows Remote granted.
3. Tap "Fetch". The log shows FAILED: TypeError: Network access is not allowed.
4. Set "TrUAPI Runtime" OFF, restart, repeat. The fetch returns 200 OK.

Start in js/container/src/index.ts, especially the lockdown logic around lines 56-67, and compare it with the built truapi-container.js in ios/truapi-host. Use 3rd-party-fetch.paseo in a testnet iOS build to reproduce the failure before and after a Remote grant. Done means an allowed domain fetch succeeds while the TrUAPI Runtime remains enabled.