Create a new iOS simulator for each lease

[thymikee]

Part of #70. See ADR 0021.

Purpose

Add an iOS policy that gives each lease a new simulator identity.

The current reusable policy can erase and grant the same UDID again. Keep that policy for existing installations.

Configuration

Store the policy in daemon configuration. A lease request cannot change it.

interface IosLifecycleConfig {
  leaseIdentity: "reusable" | "fresh";
  templateDeviceId?: string;
}

Store the selected policy on each device and lease record.

Fresh identity lifecycle

1. Create a simulator, or clone a validated template, for one future lease. Warm convergence can do this before the request.
2. Boot and check the new simulator.
3. Grant the identity at most once.
4. End the lease through release, expiry, or recovery-driven termination.
5. Delete the simulator.
6. Free capacity only after deletion succeeds.

If deletion fails, quarantine the simulator. Do not grant it again.

Template rules

Store templates as a separate device role.

type IosDeviceRole = "lease-device" | "template";

• Show templates in operator status.
• Do not include templates in lease candidates.
• Count each template against managed-device capacity.
• Count a template against running capacity only while it runs or changes state.
• Validate template ownership in the managed device set from Put managed iOS simulators in an owned device set #73.

Completion conditions

• Two sequential fresh leases for one shape return different UDIDs.
• Simlock deletes a fresh identity after release, expiry, or recovery-driven termination and never grants it again.
• A prepared warm identity receives at most one lease.
• A template cannot receive a lease.
• A deletion-pending device continues to use capacity.
• A failed deletion leaves an ungrantable quarantine record.
• Restart tests cover create, warm preparation, grant, release, expiry, and delete.
• The reusable policy keeps its current behavior.

Depends on #73 and #74.