fix(Scripts): harden simulator ownership

[kyleve]

Posted by an AI agent on kve's behalf.

Summary

• make the per-checkout simulator registry the explicit ownership authority while keeping simctl authoritative for live state
• validate checkout, UDID, device name, and exact runtime before deletion or prune
• atomically persist private registry claims and refuse to transfer a stale claim to a same-named replacement
• serialize resolve-or-create with macOS's kernel-backed lockf
• add process-level concurrency and failure tests without touching CoreSimulator

Why

Name-derived devices are useful for discovery but are insufficient proof of ownership. A duplicate name on another runtime, stale claim, or concurrent first resolution must never authorize deletion or create twin devices.

Design decisions

• shell retains xcrun simctl orchestration and live boot output
• require-safe Ruby owns structured inventory/registry policy and atomic persistence
• name-only matching may recover one unambiguous unclaimed device for use, but never authorizes deletion
• /usr/bin/lockf owns concurrency; kernel release after process death eliminates stale owner files, PID reuse, and directory-takeover races
• the persistent lock file carries no ownership state and is safe after interruption

Compatibility

Public flags, defaults, stdout/stderr conventions, and exit codes remain stable. Existing plain-text registry entries are validated and rewritten atomically.

Adversarial coverage

• same names across runtimes, duplicates within one runtime, near-substring names, and stale/moved claims
• malformed inventory/registry state and uninstalled runtimes
• create/register/delete/registry-removal failures with visible child statuses
• interrupted creation, abandoned lock files, and four concurrent first-time resolvers producing exactly one device
• exact --delete/--recreate; mutation-free --prune --dry-run
• mutations for substring matching, flattened runtimes, destructive dry-run, silent registry removal, and bypassed kernel locking are all killed

Testing

• 35 retained Ruby tests / 323 assertions at this layer
• 62 Python tests
• ./simulator --no-boot and ./simulator --list against real CoreSimulator
• ./test StuffCoreTests
• full ShellCheck, formatting, attribution, and shard-plan gates

Stack

Third PR; based on #284.

[kyleve]

Posted by an AI agent on kve's behalf.

Review focus: this is the destructive-operation boundary. A derived name is deliberately insufficient; deletion requires the registry entry plus exact checkout, device, OS, runtime, and UDID identity. A stale claim beside a same-named replacement is a refusal, not an ownership transfer.