feat(stealth): adaptive runtime profile rotation + iOS release-grade lane (handoff wired)

[ichmagmaus111]

Adaptive runtime profile rotation + iOS release-grade lane

Implements docs/Plans/ADAPTIVE_RUNTIME_PROFILE_ROTATION_PLAN_2026-06-12.md
and closes the audit findings from
ADAPTIVE_RUNTIME_PROFILE_ROTATION_AUDIT_FINDINGS_2026-06-12.md
(plan: ..._DEFERRED_FIXES_PLAN_...).

What's in here

1. Close the iOS/default release-grade gap

• New verified browser-capture AppleIosTls lane: BrowserCapture + Verified + has_independent_network_provenance + release_gating=true + TlsOnly. Wire image mirrors the reviewed iOS Apple TLS family; added last in the enum so profile_index positional arrays stay stable.
• iOS-share weight carve so the verified lane has non-zero effective weight and IOS14 is no longer the only Unknown-confidence iOS lane. iOS + Unknown + release_mode_profile_gating is now valid and resolves to AppleIosTls, never advisory IOS14.

2. Bounded, failure-driven runtime profile rotation (in-memory, opt-in, default-off)

• RuntimeProfileRotationPolicy + strict profile_rotation loader schema + [2,8] / [30,3600] validation.
• In-memory quarantine keyed by (normalized destination, BrowserProfile, hello_uses_ech), dedicated mutex, TTL; pick_runtime_profile_adaptive, note_runtime_profile_failure/success, reset hooks, counters.
• Conservative typed failure attribution: only wire-shape rejections (MalformedHelloResponse, TransportRejectionAfterHello) quarantine; WrongRegime / ResponseHashMismatch / pre-hello / out-of-enum fail closed.
• pick_runtime_profile refactored into a thin wrapper over the shared resolve_runtime_profile core (no double-selection divergence).

3. Single-selection cross-actor handoff (audit H1 — wired)

• TransportType gains an optional selected_profile. ConnectionCreator computes one pick_runtime_profile_adaptive per emulate_tls attempt and stamps it onto transport_type before the connection promise copies it, across all three connection paths (client / request-by-ip / ping).
• TlsInit uses the pre-selected profile for the emitted ClientHello (still computing ECH + per-wire-variant accounting at send time); create_transport uses the explicit-profile make_transport_stealth_config overload. The transport-shaping config and the ClientHello now carry one profile — no split profile state when rotation is enabled.

4. Hardening (audit M1, M2)

• Compile-time static_assert tying the BrowserProfile enum to the positional PROFILE_SPECS / PROFILE_FIXTURES / ALL_PROFILES arrays, plus a profile_index bounds check (M1).
• validate_runtime_profile_selection_policy requires policy.mobile.ios14 == 0 || >= 7 so the integer carve cannot truncate both verified iOS lanes to 0 (M2).

5. Tests

• New test_runtime_profile_rotation_{contract,positive,negative,edge,adversarial,stress,fuzz,handoff}.cpp + RuntimeProfileRotationTestSupport.h.
• Updated existing iOS-Unknown tests for the new AppleIosTls lane (intended behaviour change).

6. Audit docs

• ..._AUDIT_FINDINGS_... (HIGH..LOW) and ..._DEFERRED_FIXES_PLAN_.... H1, M1, M2 resolved; M3, M4 are documented decisions (a prior-success gate would forbid rotating away from a fingerprint blocked on the first attempt — the common DPI case — so the fail-safe bound + failure_threshold knob is kept; the rotation order is kept deterministic for anti-churn + H1 coherence, with the per-install salt as population-level de-correlation).

Before enabling profile_rotation.enabled=true

The handoff (H1) is now wired and clang -fsyntax-only-clean, but the connection-path changes touch the core connection lifecycle and were not run on this dev host (see below). Run the full ctest plus a connection-path integration check (one attempt uses one profile in both the emitted hello and the shaping config) on the Linux CI before flipping the flag on. Rotation stays default-off in this PR.

Verification status

All modified sources and new tests are verified compiling via clang -fsyntax-only against the real include graph. The full build + ctest were not run — this dev host has three pre-existing macOS portability gaps unrelated to this change (zlib >=1.3.2 gate, vendored tl-parser.c glibc htole32/64, logging.cpp std::atomic<std::shared_ptr<>>). Please run the full ctest on the Linux CI; a few additional cascade tests beyond the ones updated here may surface there.

🤖 Generated with Claude Code