apple-runner: make the snapshot quality verdict state a closed Swift enum

[thymikee]

Purpose

The iOS runner writes snapshot quality state as a free Swift String, while the host accepts only healthy | recovered | sparse. A typo or one-sided addition can make the host drop the verdict and its disclosure. The contracts annotation reader is looser still: it casts any string state to the verdict type.

Implementation plan

1. Next to SnapshotQuality in RunnerTests+SnapshotCapturePlan.swift, define SnapshotQualityState: String, Codable, CaseIterable with exactly .healthy, .recovered, .sparse. Use it for SnapshotQuality.state, stampedSnapshotPayload(state:), every producer in that file and RunnerTests+Snapshot.swift, and the sparse/truncation comparison. Raw-value Codable keeps the JSON values unchanged. Keep reasonCode open.
2. In packages/kernel/src/snapshot.ts, replace the repeated handwritten state union with one exported readonly state tuple and derive SnapshotQualityVerdict['state'] from it. Export a small state predicate from that owner. Have both packages/capture-kit/src/snapshot-quality-verdict.ts and packages/contracts/src/snapshot-capture-annotations.ts use it; do not import capture-kit into contracts or retain a second accepted-state set. The annotation reader must reject an unknown state rather than type-cast it. Keep its other projection behavior unchanged.
3. Add contracts/fixtures/ios-snapshot-quality-states.json containing only the three wire strings. Add a Swift runner unit test comparing fixture order to SnapshotQualityState.allCases.map(\.rawValue) and a TS test comparing the fixture to the kernel tuple. Reuse the existing fixture-path pattern in RunnerTests+SnapshotBackendCapabilitiesTests.swift; do not add a generator or a larger schema for a three-value vocabulary.

Proof and completion

• Before changing production code, demonstrate red on a one-sided extra/renamed fixture state, and red on a malformed annotation state. Keep focused tests for all three raw JSON values and for unknown-state rejection in both TS readers.
• The runner compiles with no verdict state: String or state string literals in producers, and existing encoded verdict tests retain the same wire JSON. Run the focused Swift runner unit tests and pnpm check:affected --run; report exact commands/results.
• Limit the change to the verdict vocabulary, the shared fixture, and their existing tests. No new compatibility parser, warning channel, or reason-code registry.

[thymikee]

Eager-closure gate blocks step 2's shared kernel predicate — accepted deviation from #2888.

Step 2 asks the kernel to ship isSnapshotQualityState (plus an isSnapshotCaptureBackend, the isSnapshotBackend idiom) in kernel/snapshot.ts and both readers to call it. That shape was implemented first and CI's Coverage job rejected it: run 35993787971/job 107613817783.

Why, precisely — there is no budget table to edit, which is what made this hard to find:

• scripts/__tests__/eager-closure-budgets.ts measures each entry surface's eager closure, and for any entry the merge-base already carries the budget is the merge-base measurement — eager-closure-budgets.test.ts:42 says "ratcheted against the committed merge-base rather than against a table of numbers" (tree at :518-520, per-entry assertion at :594).
• Both readers are entries because they are published package subpaths, discovered through discoverFacadeEntryFiles/facadeEntryFiles (eager-closure-budgets.ts:93), not listed in HUB_ENTRY_FILES (:103). Their budgets are therefore 9 modules for packages/contracts/src/facades/capture.ts and 2 for packages/capture-kit/src/snapshot-quality-verdict.ts, and no file in the repo states those numbers.

Measured again on 7b8b4636c's tree just now: adding the two predicates to kernel/snapshot.ts and calling them from both readers fails six carried entries — contracts/src/facades/capture.ts 10 vs 9, capture-kit/src/snapshot-quality-verdict.ts 3 vs 2, capture-kit/src/png-resize.ts 19 vs 18, capture-kit/src/recording/contact-sheet.ts 58 vs 57, capture-kit/src/snapshot/snapshot-freshness/index.ts 17 vs 16, replay-test/src/index.ts 21 vs 20. The only module both frozen closures already evaluate is kernel/snapshot.ts — the one edge the gate refuses — so no shared runtime home exists.

A full field-by-field projection in contracts (the other way to close the cast) is refused too: fallow reports a 4-group / 104-line clone family against capture-kit's normalizer, plus a complexity finding on the projected reader.

What #2888 ships instead: the kernel keeps the single declaration (SNAPSHOT_QUALITY_STATES, from which SnapshotQualityVerdict['state'] derives) and the contracts/fixtures/ios-snapshot-quality-states.json pin; each gate-frozen reader holds an exhaustive Record<_, true> keyed over the kernel union with Object.hasOwn membership, and the two readings are pinned payload-by-payload in packages/capture-kit/src/snapshot-quality-verdict.test.ts. A one-sided rename, add, or delete is then a compile error at each reader instead of a silently dropped verdict. The cost is the ~30 lines step 2 hoped to delete — which the two gates price on purpose.