chore(ios-runner): remove env knobs nobody sets, the dead back wire command, and unreachable paths #2791

Purpose

The runner still has knobs and branches that nothing can reach. Paths are under apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/; line references are at 01328de411.

Environment switches that no repo code sets:

• AGENT_DEVICE_RUNNER_DISABLE_READONLY_RETRY (RunnerTests+Lifecycle.swift:389-394)
• AGENT_DEVICE_RUNNER_DISABLE_SAFE_MODAL_PROBE (RunnerTests+SystemModal.swift:72-78). This one disables a crash guard.
• NOOP_STARTUP (RunnerTests.swift:266-269)

Unused wire command and unreachable paths:

• The back wire command. The TS resolver maps only to backInApp and backSystem (packages/platform-apple/src/interactions.ts:60-63). Remove the union member (runner/runner-contract.ts:74), the manifest row (runner/runner-command-manifest.ts:26), the Swift case (RunnerTests+Models.swift:20) and its handler (RunnerTests+CommandExecution.swift:2122-2127).
• Selector-keyed type (RunnerTests+CommandExecution.swift:2755-2776). Runner adoption checks the source fingerprint (packages/platform-apple/src/runner/runner-adoption.ts:203-214), so no older daemon can send it.
• Branches that only run on main: the Thread.isMainThread branch in executeDispatched (:1066) and case .snapshot in executeOnMainPrepared (:2055). The transport always enqueues work off main. Tests that reach these branches through the test-only execute(command:) must switch to the production dispatch path.
• The "older bridge" nil-coalescing fallback (RunnerTests+AXSnapshotFallback.swift:62). The bridge is compiled into the same target (RunnerAXSnapshotBridge.m:502-505).
• The unreachable ?? provider.runCommand('xcrun', …) in packages/platform-apple/src/core/tool-provider.ts:120-127. Make the simctl and devicectl provider fields required instead.

The env switches can still be set through the ...process.env pass-through (packages/platform-apple/src/runner/runner-process-launch.ts:88), but no repo code, CI job or doc sets them. Confirm this with git grep before deleting.

Required behavior

Delete everything listed above. No behavior change for any command the daemon sends.

Completion conditions

• git grep finds each removed identifier only in CHANGELOG or history files.
• Run pnpm check:xctest-selection, build the runner, and run the runner unit tests on the macOS host lane (see docs/agents/testing.md for signing and permissions). Add or change tests under the existing #if AGENT_DEVICE_RUNNER_UNIT_TESTS guard. Do not keep a second list of test names.
• pnpm check:affected --run and pnpm check:production-exports are green.