Ios Fleet Recording Qa

The credential lens landed in a23289a — flagging a visible username, API secret,
basic-auth blob or backend host in a submission clip — but selftest.sh was
written before it and never exercised it. Zero of the six cases touched it, so
a broken lens would have passed the suite silently. That is the exact thing
CLAUDE.md forbids: a check with no negative test proving it goes red.

Three cases added, one of which is the half that usually gets skipped:
  - D_cred.mov (Username / demo_reviewer / an agentabrams host) -> lens MUST fire
  - D_cred.mov -> verdict MUST stay TECH_PASS_PRIVACY_PENDING, because the lens
    warns by design (Apple 2.1 item #4 explicitly ASKS for demo credentials, so
    visible credentials must never hard-fail a clip)
  - C.mov (clean) -> lens MUST stay silent: the false-positive guard

Proven by fault injection, not just by passing: neutering all four CRED_*
patterns makes the suite report "credential lens did NOT fire" / SOME FAILED;
restoring them returns ALL PASS (9/9). recording-qa.sh verified byte-identical
to HEAD afterwards, so the injection left no residue.

Also re-verified the pre-existing gate end to end before touching it: ffprobe,
ffmpeg, tesseract and shasum all present, and the original 6 cases still pass —
including the two that matter most for App Review, a simulator clip rejected as
REJECTED_NOT_DEVICE and --approve refusing to bind a review to a PII clip.

Refs TK-11155.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Found empirically under TK-11155: the real GovArbitrage on-device capture
(1320x2868, 68s) passed the gate TECH_PASS + 'OCR clean' while its Settings
frame showed a plaintext 'Username admin' and the backend host
https://auctions.agentabrams.com. The OCR scan only looked for
email/phone/street-address, so credentials were invisible to it.

Adds a 4th lens over the SAME already-extracted frames (no extra cost):
visible username, api-key/secret/bearer/token, Basic <base64>, and internal
backend hosts. Credential labels sit on their own OCR line above the value
('Username\n\nadmin'), so it matches a newline-flattened copy, skips masked
values (dots/asterisks), and drops label-plus-ordinary-word noise.

WARNS, never hard-fails: Apple's Guideline 2.1 item #4 explicitly asks for
demo credentials, so visible creds must be a conscious choice, not a silent
pass. Verdicts and exit codes are unchanged; count surfaces in the human
output and as cred_hits in --json.

Verified: selftest 6/6 PASS (no regression); real clip now reports 11 hits
across username + backend-host, exit still 0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SEhnWQSSkAhSYxWXHJ3MCw

Rebuilds the verify-recording/privacy-scan/readiness-probe the TK-11155 memos assumed existed.
Verdicts: TECH_FAIL / REJECTED_NOT_DEVICE / PRIVACY_FLAGGED / TECH_PASS_PRIVACY_PENDING / READY_TO_SEND.
Device-metadata absence is a warning (AirDrop/re-encode strips it), not a false reject.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YNivxV68DdxP1rvhViBfcN