#3877 perf(ios): ask a ready runner about surface hosts before spawning probes

Summary

Stacked on #3873; retarget to main once it merges.

Every iOS simulator capture ran the host-side system-surface probe first: two pgrep -f spawns plus ps environment reads. That costs 50–150 ms per capture, and --settle makes 2–3 captures. Since #3873, a ready runner's read of every registered host's XCUIApplication.state decides the route anyway, and it answers in a few milliseconds.

The route now asks a ready runner first:

• Every host off screen: stay on the bridge, with no process probe.
• A foreground host: take the runner route with that host.
• No ready runner, or a failed read: run today's process probe.

#3873's later refinement step is gone, since a present from the probe now only arrives when the runner could not answer. The ADR 0004 paragraph is updated.

4 files.

Validation

• pnpm check:affected --run --head d2dcc82027: passed.
• New route tests fail at #3873's head 10bc49d00e, 3 of 4 cases.
• Live, Bluesky 1.136.0 (real account, SafariViewService lingering), iOS 27.0 simulator, 6× snapshot -i, daemon request time:
  • base 10bc49d00e: 194–316 ms (median ~281), 2 pgrep + 4 ps spawns per capture.
  • head d2dcc82027: 110–142 ms (median ~117), 0 pgrep, 3 ps (target resolution).

🤖 Generated with Claude Code