CI: add a supervised device (+ supervisor identity) to the e2e device farm

[danielpaulus]

Motivation

Several go-ios features can only be exercised on a supervised device with a known supervisor identity (PKCS#12), and we currently have none in the CI farm — so this whole class of functionality ships with zero automated real-device coverage.

Concretely, blocked today:

• ios mdm fetch-unlock-token / clear-passcode / clear-screen-time-password (PR feat(mdm): add supervised passcode and Screen Time management commands #778) — supervised-only, need a supervisor p12. The PR's PairSupervised locked-device change is only partially exercised by the existing pairing e2e.
• TestProfileAddRemove (test/e2e/skipped_test.go) — already skipped with the note "needs a supervised device and a .mobileconfig fixture"; installing/removing a config profile on an unsupervised device requires manual approval in Settings.
• Supervised-gated MCInstall paths generally: SetWallpaperSupervised, cloud-configuration, and the Escalate channel.

What's needed

1. A supervised iPhone on one of the self-hosted runners (ganjalf / office01). Supervision is done via Apple Configurator (or cfgutil) with an organization identity; the device is erased and re-enrolled as supervised.
2. The matching supervisor identity (the org's PKCS#12 + password) stored as GitHub Actions secrets, e.g. GO_IOS_E2E_SUPERVISOR_P12_B64 + GO_IOS_E2E_SUPERVISOR_P12_PASSWORD, mirroring how the App Store Connect signing key is injected in real-device.yml (base64 → decode to $RUNNER_TEMP at job start).
3. A repo variable listing the supervised UDID(s), e.g. GO_IOS_E2E_SUPERVISED_DEVICES, so the supervised tests target only that device and skip cleanly elsewhere (same pattern as GO_IOS_E2E_LINUX_PREIOS17_DEVICES and the DDI-gated pasteboard tests).
4. A committed .mobileconfig test fixture for the profile add/remove test.

Test wiring (once hardware exists)

• Un-skip TestProfileAddRemove and gate it on GO_IOS_E2E_SUPERVISED_DEVICES.
• Add an e2e test for the feat(mdm): add supervised passcode and Screen Time management commands #778 mdm commands: on the supervised device, fetch-unlock-token (device must have no passcode) → round-trip through clear-passcode; clear-screen-time-password smoke test. All skip when the supervised-device var is empty.
• Consider a supervised-only PairSupervised test covering the locked/no-EscrowBag path.

Notes / caveats

• Supervision erases the device — dedicate a phone to this, don't repurpose one of the currently-wired e2e phones without planning.
• fetch-unlock-token specifically requires the device to have no passcode set at capture time, which constrains automated setup.
• Fork PRs can't see the supervisor secret (same trust model as the signing key), so these tests run on same-repo PRs and via /test-devices only.

Tracking issue; no code change required to file it. Related: PR #778.