Fail closed for unresolved synthesized coordinate fill on iOS

[thymikee]

Problem

The iOS coordinate fill path can use synthesized-first-responder-replacement when the requested coordinate does not resolve to a concrete text-entry element, a refresh point exists, and the XCTest channel is penalized. In that state, replacement is dispatched through the application-level first responder without concrete element identity or post-write verification.

If focus still belongs to a previous field, an unresolved coordinate fill can therefore replace text in the wrong input while returning a completed result with verified: nil. This behavior predates #1700; it is separate from the bare-type witness fix merged there. It is also distinct from #1718, which tracks parent-owned touch-point parity for direct selectors and Maestro.

Relevant seams:

• RunnerTests+SynthesizedTextEntry.swift: shouldUseSynthesizedFirstResponderReplacement and runSynthesizedReplacementRoute
• RunnerTests+TextEntry.swift: coordinate target resolution and refresh-point fallback
• src/platforms/apple/interactions.ts: coordinate fill dispatches replacement mode

Closure

• Fail closed when coordinate fill cannot bind synthesized replacement to the intended text-entry target, or introduce a concrete target/commit signal that provides equivalent safety.
• Add a red/green iOS regression proving an unresolved coordinate fill cannot mutate a previously focused field.
• Preserve the penalized-channel replacement path for a concretely resolved coordinate target.
• Report a structured actionable failure instead of an unverified success when safe replacement cannot be established.
• Update the interaction guarantee classification and contract coverage if the fix changes a declared dispatch-path guarantee.