fix(cli): prefer fresh iOS builds during onboarding

[BenSheridanEdwards]

Summary

• Prefer the iOS source-project onboarding build path before generic artifact discovery.
• Prevent stale .app output inside an iOS checkout from being reused when nativeproof onboard /path/to/ios-repo should build and stage a fresh simulator app.
• Add a regression test that proves stale source-tree output loses to the freshly built derived-data app.

Proof

• npm run check passed (biome check . && tsc --noEmit; checked 48 files).
• npm test passed (184 tests, including onboard builds an iOS project instead of reusing stale app output and packed-package onboarding smoke).
• Generated project/device proof, or N/A: npm test includes packed package exposes the onboarding CLI bins and ESM scaffold; npm pack --dry-run --json also passed for nativeproof@0.13.0 with 48 packed files. Device lane not applicable; no live Appium/device behavior changed.

Risk

• Low. This only changes target resolution order for directories that look like iOS source projects; direct .app, .apk, and Android artifact onboarding still use existing detection.

Notes

• Full device coverage not run: Not run because this is CLI target-resolution behavior. The iOS build path is covered with an injected fake xcodebuild runner and the package smoke remains green.

PR Proof Law

• I followed .agents/DEFINITION_OF_DONE.md and .agents/skills/pr-inline-screenshot-proof/SKILL.md.
• Screenshots are committed and embedded inline with ![alt](...png?raw=1), or the proof section says Not applicable with the technical reason.
• The PR body has no bare screenshot links, local paths, relative paths, or proof placeholders.

Screenshots: Not applicable — this is a CLI/onboarding routing fix with no rendered UI or screen state to capture. Behavioral proof is the committed regression test plus the full local command proof above.