ci: route trusted iOS checks to M1

[wolfiesch]

Summary

• route affected iOS checks from trusted same-repository pull requests to the provisioned M1 runner
• retain hosted macOS for forks, pushes, merge groups, and circuit-breaker fallback
• compile only the active ARM64 simulator architecture on the M1
• protect the trust-routing contract with the release-consistency check

Measured result

At commit 8a096d543cbed56d4adec266a63ccd808c8de568, isolated runs of the real five-test XCUITest lane completed in 3m34.78s cold and 2m50.70s warm on the M1, versus the 5m45s hosted baseline.

The exact PR head a65221c1f3f6a50c2c7bb9082ff45e6293f0304a then passed on wolfie-m1-omperator in live Actions run 30239406165:

• first full iOS job: 5m00s
• warm job rerun: 4m25s
• hosted baseline: 5m45s
• required verify: green after 3m17s wall-clock on the first run

The live warm lane is 1m20s (about 23%) faster than hosted while all Linux jobs remain parallel on separate hosted runners.

Verification

• pnpm check on Node 24.13.1
• pnpm test:tooling on Node 24.13.1 (136 passed, 1 platform skip)
• actionlint v1.7.7
• five XCUITest cases passed on both live Actions attempts
• all PR checks green on the exact head