test(truapi): cover the account-holder split

[pgherveou]

experimental do not review yet

Tests for the behavior #1302, #1303 and #1305 add: 53 Rust tests and 11 Kotlin and Swift tests, with the fixtures only they use. No production code changes.

• Rust: wallet activation races, consent and Allow once, paired callers sharing stored decisions, AutoSigning issuance, native allowance retention and cleanup, the SSO request service's session persistence, the responder's per-peer binding, confirmation at each entry (relayed requests on the phone, background allocation without a prompt, the own-subtree prompt only on a paired host, no renewal request from a paired host), the Bulletin signer.
• Hosts: Android encrypted storage and host core storage, iOS Keychain-backed core storage, two iOS SSO handler tests.
• Fixtures: storage and prompt gates on StubPlatform, the scripted RPC pause, the Bulletin nonce hold.

Validation: Rust workspace tests, Android host unit tests, iOS SDK build-for-testing; CI green.

[github-actions]

This pull request touches an app, which is not built by default. Add a label for each build you want:

• iOS simulator build, ios-simulator-build: builds the iOS app, runs its tests and attaches a build for the iOS Simulator on a Mac.
• iOS device build, ios-device-build: attaches a signed build that installs on a registered iPhone or iPad.
• Android build, android-device-build: attaches an APK that installs on an Android phone or an emulator.

Each starts as soon as it is added and follows the branch from then on.

[github-actions]

CI Status: 24 required jobs green, 21 passed and 3 skipped by path filter.

All job results

job	result
android-bindings	success
bundle-size	success
changes	success
changeset-guard	success
cli-package	success
codegen	success
e2e	skipped
explorer	success
headless-install	success
host-android-bindings	success
host-android-detekt	success
host-wasm	success
ios-bindings	success
ios-swift	success
licenses	success
playground	success
provider-android-bindings	skipped
release-guard	success
rust	success
ts-client	success
ts-debugger	success
ts-host	success
wasm-provider	success
workflow-lint	skipped

Signing credentials: failure as of 2026-10-13, a release may fail

_{Commit 4e3e74aa · run log}

[github-actions]

Bundle size report

Compared with main at 10a36af.

	Raw	Gzip	Brotli
truapi-host	7.95 MiB (+84.8 KiB, +1.1%)	5.68 MiB (+30.8 KiB, +0.5%)	5.40 MiB (+22.2 KiB, +0.4%)
truapi-provider	4.03 MiB	1.27 MiB	960.2 KiB
truapi	6.29 MiB	890.4 KiB	729.2 KiB
Total	18.27 MiB (+84.8 KiB, +0.5%)	7.83 MiB (+30.8 KiB, +0.4%)	7.05 MiB (+22.2 KiB, +0.3%)

WebAssembly modules

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.84 MiB (+84.2 KiB, +3.0%)	1014.2 KiB (+30.6 KiB, +3.1%)	763.1 KiB (+22.1 KiB, +3.0%)
truapi-host/wasm/web/truapi_verifiable_bg.wasm	4.89 MiB	4.64 MiB	4.61 MiB
truapi-provider/truapi_provider_bg.wasm	3.99 MiB	1.26 MiB	952.4 KiB

Changed files (4)

	Raw	Gzip	Brotli
truapi-host/wasm/web/truapi_server_bg.wasm	2.84 MiB (+84.2 KiB, +3.0%)	1014.2 KiB (+30.6 KiB, +3.1%)	763.1 KiB (+22.1 KiB, +3.0%)
truapi-host/generated/host-callbacks.js	10.8 KiB (+428 B, +4.0%)	3.5 KiB (+113 B, +3.3%)	2.9 KiB (+109 B, +3.8%)
truapi-host/generated/host-callbacks-adapter.js	7.2 KiB (+122 B, +1.7%)	1.6 KiB (+18 B, +1.1%)	1.4 KiB (+20 B, +1.4%)
truapi-host/generated/worker-callbacks.js	7.4 KiB (+101 B, +1.4%)	1.5 KiB (+18 B, +1.2%)	1.2 KiB (+16 B, +1.3%)

_{Commit: 4e3e74a}

[pgherveou]

Collapsed into #1302, which carries this work as separate commits. The branch stays as it is, and a backup is in backup/account-holder-*-2026-10-14-collapse.