iOS CI on GitHub Actions

Xcode builds from scratch and code signing is fragile in CI.

Why it happens

DerivedData is discarded between runs and signing assets have to be imported into a fresh keychain each time.

What to change

1. Persist DerivedData between runs — this is the single biggest win
2. Use a dedicated CI keychain and import the certificate once per job
3. Pin the Xcode version explicitly with xcode-select
4. Shard UI tests across simulators rather than running them serially

iOS on runnerhut

jobs:
  ios:
    runs-on: runnerhut-macos-15-m4
    steps:
      - uses: actions/checkout@v4
      - run: sudo xcode-select -s /Applications/Xcode_16.4.app
      - run: |
          xcodebuild test \
            -scheme App \
            -destination 'platform=iOS Simulator,name=iPhone 16' \
            -derivedDataPath ~/Library/Developer/Xcode/DerivedData

The only runnerhut-specific line is `runs-on: runnerhut-macos-15-m4`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.