ios build never provisions the pinned Xcode/iOS workload, so PR-validation jobs still need toolchain YAML (iOS plan §4/§6) #184

What's missing

The iOS support plan puts toolchain provisioning inside KtsuBuild for every iOS job, not only for signed packaging:

• Plan: docs/ios-support-plan.md L169-L173

  Toolchain provisioning (macOS only). Select Xcode and install the pinned iOS workload via a rollback file. … Fail loudly when the workload is missing.

• Plan: docs/ios-support-plan.md L273-L276

  What changes is that the Xcode selection, workload pin, selective restore, frameworks check, signing, archive, and upload all move out of the workflow and into KtsuBuild

What exists today

• KtsuBuild/Ios/IosService.cs ProvisionToolchainAsync (around L308) selects Xcode and installs the workload from IOS_XCODE_VERSION / IOS_WORKLOAD_VERSION. The values are read in BuildConfigurationProvider.cs:200-201.
• Its only caller is IosService packaging (L77), which runs just before signing setup. That means the pins are applied only on the signed ios package path.
• The unsigned ios build path does not provision. Neither does the ci auto-run of the iOS build on macOS (IosBuildService and the ios build handler).
• CLAUDE.md ("iOS Pull-Request Validation", around L372-377) still says: "The macOS runner, Xcode selection, and iOS workload pin still live in the consumer workflow for now (toolchain provisioning is a later phase)".

Why it matters

A consumer's PR-validation job has to keep its own xcode-select and dotnet workload install --from-rollback-file steps, so the pins are maintained in two places. A PR build and a release build can then use different Xcode or workload versions. That is exactly the drift the plan set out to remove, and MeltdownMonitor already had to chase it.

Acceptance criteria

• On a macOS host, ios build, and the ci iOS auto-run, call ProvisionToolchainAsync with the configured pins before building. When the pins are empty it does nothing, as today.
• A workload that can't be installed fails the command with a clear error. The plan's "fail loudly" requirement applies.
• Unit tests with a mocked IProcessRunner assert the Xcode and workload commands issued on the build path, and assert that nothing is issued when the pins are unset.
• The CLAUDE.md iOS PR-validation sample job drops its toolchain steps, and the "later phase" note is removed.

Dependencies

None. It reuses the existing IosService helpers. It is related to #176 (host-filtered restore and build), but that is independent of this change.