refactor(apple): carry one phase Deadline through the runner interfaces and test cancellation as a matrix - #2473

Follow-up to #2423, on the two points raised in review: encode one shared Deadline per runner phase in the owning interfaces, and turn #2423's ad-hoc cancellation cases into a matrix.

Behavior is unchanged. This is an interface + test change.

1. One phase budget at the boundary

#2423 fixed the symptom (a cold toolchain-probe stall no longer adds its 30-45 s on top of the phase budget) but left the shape that produced it: each phase entry point took a number, converted it to a Deadline internally, and then handed the deadline plus a signal onward in a separate bag - while the original number stayed in scope and reachable. Adoption took both startupTimeoutMs and phaseDeadline; requireRunnerPhaseRemainingMs took the deadline and a numeric fallback. A number that two callees can each turn into a budget is exactly the double-spend class.

Now a phase is opened once, from the public numeric option, and every boundary below it takes that one object.

Before:

export function createRunnerPhaseDeadline(timeoutMs: number | undefined): Deadline | undefined;
export function requireRunnerPhaseRemainingMs(
  deadline: Deadline | undefined,
  fallbackTimeoutMs: number | undefined,
  phase: string,
): number | undefined;

type RunnerCacheProbeBudget = { deadline?: Deadline; signal?: AbortSignal };

ensureXctestrunArtifact(device, { buildTimeoutMs?: number; signal?: AbortSignal; ... });
tryAdoptRunnerSessionFromLease(device, {
  startupTimeoutMs?: number;
  phaseDeadline?: Deadline;
  signal?: AbortSignal;
  expectedRunnerSessionId?: string;
});
resolveExpectedRunnerCacheMetadata(device, projectRoot?, budget?: RunnerCacheProbeBudget);

After:

/** The single clock every step of one phase reads, plus the owning request's cancellation. */
export type RunnerPhaseBudget = Readonly<{ deadline?: Deadline; signal?: AbortSignal }>;

/** The one place a number becomes a budget. */
export function createRunnerPhaseBudget(
  timeoutMs: number | undefined,
  signal: AbortSignal | undefined,
): RunnerPhaseBudget;

/** Still the one "what is left, or fail before spawning" reader - no numeric fallback to re-read. */
export function requireRunnerPhaseRemainingMs(
  budget: RunnerPhaseBudget | undefined,
  phase: string,
): number | undefined;

ensureXctestrunArtifact(device, { budget?: RunnerPhaseBudget; ... });
tryAdoptRunnerSessionFromLease(device, {
  budget?: RunnerPhaseBudget;
  expectedRunnerSessionId?: string;
});
resolveExpectedRunnerCacheMetadata(device, projectRoot?, budget?: RunnerPhaseBudget);

• Public numeric options stay where external callers set them: ensureRunnerSession still takes the request-level startupTimeoutMs and buildTimeoutMs, and is the one owner that converts - startup once, and the build as its own phase (the build must not be capped by what startup has left, as before). The cache prewarm in runner-client.ts opens the build phase it starts.
• createRunnerPhaseDeadline is gone: its two call sites became one factory that also carries the request signal, so the clock and the cancellation a phase is read against can no longer be paired up wrongly.
• The signal rides in the budget because both are read at the same guard (ToolchainProbeClock.throwIfCanceled / attemptTimeoutMs), and startRunnerSessionWithLease no longer re-resolves it.
• Dropping the numeric fallback is behavior-preserving: a caller with no timeout number has no deadline either, and normalizeRunnerStartupTimeoutMs already discarded non-finite values.

2. Cancellation as a matrix

runner-cache-metadata.test.ts - one table-driven test over resolveExpectedRunnerCacheMetadata, each row naming when the request aborts, what the probe it lands on does, the expected outcome, the exact exec count and the wall clock spent:

snapshot-source/cache-identity.test.ts - the same table over its smaller surface: aborted before the deadline is opened (0 execs), aborted while the first probe blocks and times out, aborted while it fails with a non-timeout error (the probe's own failure: a non-timeout failure is never retried, so there is no retry to cancel), aborted as the timeout unwinds before the retry, and no abort with the whole deadline spent (the timeout propagates unchanged).

The named tests that cover non-cancellation behavior are kept as they were: budget sharing across the retry ([30 s, 15 s]), a phase with 4 s left getting one 4 s attempt, and a probe whose own message merely says "timed out" not being retried.

Removing the cancellation guard from createToolchainProbeClock fails exactly the 7 abort rows and leaves the 2 non-abort rows green.

Verification

typecheck (packages clean), lint, check:layering, check:affected --run, scripts/__tests__/eager-closure-budgets.test.ts (no growth), and the four touched test files.

Note: main at 6d08de4 does not typecheck - --until (#2436) landed without the projectConfig/recorded fields that #2453 made required on FlagDefinition, in src/commands/cli-grammar/flag-definitions-action.ts. That failure is inherited, not from this branch, and clears on a rebase once main is fixed.