#4176 fix(limrun): stop answering appstate for an unreachable iOS instance

Summary

Limrun iOS appstate answered from the session record even after the instance was terminated. Per the maintainer decision on the issue:

• A failed read now fails appstate instead of answering from the session. This also changes local iOS: a busy runner now fails.
• Limrun iOS answers from the session only after listApps confirms the instance responds. Otherwise it fails with limrun_instance_unreachable.
• Any provider whose session has ended refuses with owner-capability-missing, and capabilities no longer advertises appstate then.

18 files. Closes #3924.

Validation

Tested 03a062138. pnpm check:affected --run --head 03a062138: all runnable checks passed (41 passed, 25 skipped by selection; unit 17016 passed, 1 skipped, 0 failed). A new daemon-level test covers a rejecting listApps, and it fails with the probe removed. Earlier gate failures at 0f0c41801 remain unproven.

Local iOS simulator (iPhone 17, com.apple.Preferences): appstate reported source: session with no runner, and source: runner, state: runningForeground after snapshot started one.

Unresolved:

• No live Limrun run. It is not merge-ready: I have no Limrun credentials, so the terminated-instance path and its elapsed time are not measured on the real SDK.
• Limrun still has no foreground read, so source: session reports the last opened app.
• Live WebDriver and Revyl iOS sessions answer without a liveness check, because the decision names only Limrun.
• A silently dead socket can take up to the SDK's 30s timeout.

🤖 Generated with Claude Code