ios: fill's verified element route cannot recover from a field whose app writes its value back mid-burst

[thymikee]

Purpose

The pace bound in #2878 protects only the synthesized-first-responder-replacement route, which exists only when the XCTest snapshot channel is already penalized. The verified XCUIElement route, which is what most fill calls take on a healthy simulator, is corrupted by the same app behaviour, and its repair path cannot recover from it.

Required behavior

fill onto a field whose app re-applies its own value while the burst is in flight (a controlled React Native TextInput, an async validator) either ends with the requested text or fails with a typed reason naming the collision. It must not report ok on a truncated value, and it must not spend its repair budget re-typing into a race it always loses.

Observable completion conditions

• A lane test drives fill through the verified element route against the --agent-device-text-entry-async-value-write fixture introduced in Enforce simulator-set scope for simctl: device scope for any udid, set scope only for calls that name no device #2878 and asserts the exact value.
• verifyTextEntryWithRepairIfNeeded's replacement-mode assumption that any mismatch is repairable is either proven or replaced by a typed outcome, with the mismatch case pinned.

Evidence

Runner host app with that fixture, iPhone 16 Simulator, iOS 26.2:

• element route: corrupted 10/10 (ada@example -> adxe, Ada Lovelace -> ALa).
• the existing clear-and-retype repair converged 0/10: every retype raced the same write.
• per-character entry with --delay-ms 80: correct 10/10, which is what identifies the burst pace, not the event stream, as the collision.

Dependencies

Blocked by: #2080 as shipped in #2878, which bounds the synthesized route only.