Put managed iOS simulators in an owned device set

[thymikee]

Part of #70. See ADR 0021.

Purpose

Put all Simlock-managed iOS simulators in one owned CoreSimulator device set.

Simlock already stores provenance for each device. This issue adds ownership and isolation for the device-set root.

Configuration

Add one daemon setting. A lease request cannot change it.

interface IosDriverConfig {
  deviceSetPath: string;
}

When Simlock creates a new empty root, it also creates an ownership marker.

interface DeviceSetMarker {
  schemaVersion: 1;
  owner: "simlock";
  instanceId: string;
}

The exact file name is an implementation choice. The marker content and validation rules are part of the contract.

Required behavior

• Resolve the configured root to its canonical path.
• Refuse a symlinked root or marker.
• Check the root owner and permissions.
• Require the marker instanceId to match the configured Simlock instance before discovery or mutation.
• Create a marker only for a new empty root that Simlock creates.
• Refuse every existing unmarked root.
• Allow a non-empty root only when its valid marker matches the configured instance.
• Never adopt or mark a pre-existing root.
• Do not infer ownership from simulator names.
• Do not accept a device-set path in a lease request.
• Add the configured set to every iOS list, create, clone, boot, erase, shutdown, and delete operation.
• Limit iOS recovery and cleanup to records from this device set.

For example, all simulator commands must use the configured root:

xcrun simctl --set "$SIMLOCK_DEVICE_SET" list --json

Error contract

Return one typed doctor finding when validation fails.

interface IosDeviceSetError {
  code: "IOS_DEVICE_SET_INVALID";
  reason:
    | "missing-marker"
    | "invalid-marker"
    | "wrong-instance"
    | "symlink"
    | "wrong-owner"
    | "wrong-permissions"
    | "non-empty-unowned-root";
}

Completion conditions

• Simlock cannot erase or delete a simulator outside the configured set.
• A simulator with the same name in another set is not visible to Simlock.
• Startup accepts a non-empty root with a valid marker for the configured instance.
• Startup fails closed when root validation fails.
• Two Simlock homes cannot accept each other's device-set marker.
• Two Simlock homes can use separate device sets without cross-access.
• Tests prove that request input cannot redirect a destructive operation.

This issue blocks #75 and the iOS part of #77.