Freeze retained-wallet modernization for release qualification

[takemiyamakoto]

Summary

This is a stacked draft PR onto modernize (#467). It freezes the current wallet modernization changes as a reviewable source revision.

• Keep retained 15/18/21-word legacy mnemonic wallets on their existing SORA2 identity; admit Nexus/Taira derivation only for supported 12/24-word sources.
• Harden wallet recovery, network admission, and related onboarding and security flows.
• Bind the retained-wallet policy to migration source gates, negative mutation checks, and recovery tests.
• Compile the unsigned Release app and test targets against the iPhoneOS arm64 SDK in CI, alongside the Release simulator XCTest suite. This checks device SDK compilation and grants no distribution authority.
• Record the exact wallet-opening localization gap in Fixtures/Modernization/ios-wallet-opening-localization-handoff.md: eight new messages remain missing from 31 locale catalogs; Try again reuses the existing retry-action label in 30 catalogs; Catalan derives Torna-ho a provar from its checked-in Please try again translation, pending language review. The storage-upgrade, retained-wallet recovery, and PIN-unavailable retry actions now use that same existing label. Preserve the asset symbol in Azerbaijani and Serbian insufficient-balance warnings. Restore the missing Hungarian QR-share argument and slippage arguments in Dutch and Polish. Repair ten further format placeholders in Persian, Hindi, Italian, and Azerbaijani while preserving the existing translated wording. The 61-key format-token audit now finds zero mismatched locale/key pairs.
• Resolve raw-key and blank-label behavior for incomplete catalogs: generated R.swift accessors now select a nonempty value by key and fall back to English, preserving valid .stringsdict plurals. WalletUX.text skips empty values. Active legacy transfer and QR errors use 11 explicit English defaults where the old dotted keys have no shipped English entry; the transfer title uses its existing R.swift translation. All 33 catalogs remain bundled. Product and language-owner approval of English fallback remains open.

Verification

• The clean-worktree source gate, verify-modernization-dependencies.sh --lint-ios-migration-release-source-gate, passed at current head 4bf5209b. The observed-only archive wrapper archive-ios-migration-candidate.sh --lint-contract also passes at this head.

• A local unsigned generic-iOS Release build-for-testing completed on Xcode 27. Its app binary is arm64, has bundle ID co.jp.soramitsu.sora, and has no top-level code signature. The unsigned Release device compile passed in CI for prior head e88dca74 on the pull request merge checkout (29m23s); all three checks passed at prior head 2f538658 after the locale-only edits; all three exact-head CI checks pass at 4bf5209b: source contract, full Release XCTest closure, and unsigned Release device compile. The earlier local build checked candidate source before the localization-only balance, retry, QR-share, slippage, and recovery-button corrections.

• Before the documentation and CI-only commits, the same app source passed the non-promoting Release simulator selection: 323 unit tests, 19 integration tests, and 3 UI tests (2 documented environment skips), zero failures. The local result bundle is retained under /private/tmp/sora-ios-prod-readiness.BQRuRH/FullClean.xcresult. The full Release XCTest closure passed in CI for prior head e88dca74 on the pull request merge checkout (43m44s), alongside the source contract and unsigned device compile checks. All three CI checks passed at 0531e5a3: source contract, full Release XCTest closure, and unsigned device compile. All three CI checks passed at prior 2f538658: source contract, full Release XCTest closure, and unsigned Release device compile. All three exact-head CI checks pass at 4bf5209b: source contract, full Release XCTest closure, and unsigned Release device compile.

• On current 4bf5209b, four focused unsigned Release simulator XCTest cases passed with zero failures, covering selected, missing, empty, formatted, plural, and active legacy message fallback. The vendored R.swift package passed 23 tests, generated source parsed for arm64 iOS Simulator, and the Release source gate passed (94 migration, 8 internal TestFlight, 17 Release-package, 15 Taira, 10 vendored-binary, 10 signing-identity, and 20 promotion tests; 13 lints and parse). See Fixtures/Modernization/ios-localization-fallback-qualification-20260925.md.

• Read-only dependency alert review found six open SwiftNIO-family Dependabot alerts on the older develop workspace lock. This candidate, stacked on modernize Modernize #467, pins patched swift-nio 2.100.0, swift-nio-extras 1.34.1, and swift-nio-http2 1.44.0 in its project workspace lock. The default-branch alerts remain open until patched pins reach develop; final signed IPA contents are not established by this lockfile check.

Release admission

This PR does not authorize distribution. The pinned Apple Distribution certificate and App Store profile are installed and match the candidate inventory, but protected signing admission still fails closed on missing release-controller pins and dual-authority receipt. The non-authorizing signing source-contract SHA-256 at 4bf5209b remains d9993da68529a43b49b145dcf1a78c469df7d09995b3a0d2e4b61b2741f35810. Retained-device migration, vendored-binary, and rollout receipts remain required for an exact-source IPA. The newly added wallet-opening localization handoff still has 248 missing locale/key pairs, and a broader audit found 5,060 missing nonempty English-key/locale pairs across the 32 non-English catalogs; reuse of 30 existing retry labels and the Catalan phrase is not language-review approval. The key-aware fallback now displays English for missing or empty selected values where the English catalog has text. The legacy L10n path still has historical inactive keys without shipped defaults; the 11 active error messages have explicit English defaults. English fallback is not translation approval. A separate local audit of 61 English formatted keys now finds zero mismatched format-token pairs after the two Azerbaijani and Persian argument repairs. The public TestFlight links do not identify the build currently available to testers, and previously uploaded build 2026091402 does not bind this candidate revision. Production capability flags remain closed pending candidate-bound admission and funded canaries.