Codex/test ios keyboard liveview fix

[kryptocodes]

Summary

Fixes the ~309px black band at the bottom of the LiveView viewer on iOS Safari once the user types the first character into a remote field. Three independent causes:

• measure() was subtracting visualViewport.offsetTop from the keyboard height. offsetTop is pan position, not occlusion, so a still-docked keyboard reported occludedBottom: 0 and the viewer dropped its lift. Now max(layoutBaselineHeight, innerHeight) - vv.height, with a latched pre-keyboard baseline because Safari eventually shrinks innerHeight onto the already-shrunk visual height. Same fix on the legacy parent-viewport path.
• A position: fixed; height: 100% iframe follows Safari's shrinking layout viewport. pinFrameForKeyboard() pins the pre-keyboard box in CSS pixels (bottom: auto) for the keyboard session and cancels the viewport pan with translate3d(0, vv.offsetTop, 0). Opt out with pinKeyboardHeight: false.
• The DOM proxy input sat under the remote field, where WebKit pans the top-level visual viewport on the first character. On iOS it now sits in the top safe strip (y = 24); Android keeps its under-finger placement.

Validation

• node --test kbd/test/*.test.mjs — 431 pass, 0 fail.
• New kbd/test/host-measure-android.test.mjs (7 tests): layout-resize keyboard reports no occlusion in either update order; baseline relearns downward; VirtualKeyboard rect outranks the baseline; visual-only shrink still pins and reports; baseline survives the iOS mid-session innerHeight collapse.
• Also new/extended: ios-proxy-placement, host-geometry, host-embed-layout, portal-blind-host, kbd-pan-reach.

Risk and Rollback

• Frame pinning writes height/bottom/top/transform on the embedder's iframe for the keyboard session, restored on dismiss. position: fixed only.
• Latch and pin are one mechanism: with pinKeyboardHeight: false or a non-fixed iframe, a frame that follows the layout shrink gets a full keyboard height of claimed occlusion. Needs the iOS ordering (visual viewport shrinks before innerHeight). Locked down as "KNOWN GAP", not fixed.
• Android is in scope but clean: Chrome returns from the VirtualKeyboard branch; without it, the both-viewports-agree guard reports no keyboard as before. Residual surface is the pin only; translate3d is inert there.
• 700ms dismissal lag on the host-geometry path (HOST_ZERO_CONFIRM_MS). Blur, tap-away, and resetLayoutMode still reset immediately.
• Rollback: git revert d833f50. Partial: pinKeyboardHeight: false.

Checklist

• I kept the change focused.
• I updated tests or documentation when needed.
• I did not include secrets, credentials, private infrastructure details, or production configuration.
• I noted any license, security, or privacy considerations.