fix(device_batch): return bare ref id from findRefByTestID (#396)

[Lykhoyda]

Summary

Fixes #396 — device_batch testID steps failed on the in-tree runners with a misleading STALE_REF (Element at ref @@e68 no longer hittable — UI re-rendered since snapshot), directly contradicting the tool schema's promise that testID steps "re-resolve via snapshot at execution time … immune to layout-change drift".

Root cause

• The in-tree iOS/Android runners emit snapshot envelope refs @-prefixed (mapRunnerNodesToFlat → ref: '@e68'); the deleted agent-device daemon emitted them bare.
• findRefByTestID passed the envelope ref through verbatim.
• The three testID branches of device_batch (find+tap / press / fill) compose the target as `@${ref}` → @@e68.
• lookupRef strips exactly one @, so refMap.get('@e68') misses (keys are bare e68) and the _staleRef sentinel mislabels a fresh-snapshot resolution as "UI re-rendered".

Net effect: every testID-keyed batch step failed on both in-tree runners — the exact stale-ref failure mode the parameter exists to eliminate, plus a false diagnosis.

Fix

findRefByTestID now returns the canonical bare id in both envelope shapes (flat nodes + nested tree) via a bareRef helper. The @${ref} composition at the call sites is now always single-@. The second consumer (expect_visible_by_testid) only checks presence, so it is unaffected.

Tests

• New GH bug: device_batch testID steps resolve against a stale cached snapshot, contradicting the re-resolve-at-execution contract #396 regression tests: @-prefixed runner envelopes (flat + tree) resolve to bare ids; a composed-target invariant test pins /^@[^@]/ for both envelope ref styles (this test reproduces the on-device @@e151 failure before the fix).
• GH Test coverage gap: agent-device dispatch tiers (fast-runner / daemon / CLI) under realistic envelope shapes #114 producer-consumer contract tests updated: the in-tree iOS/Android expectations (@e7/@e12) had pinned the buggy passthrough — now pin the bare-id contract. Legacy-tier expectations unchanged, proving bare refs pass through untouched.
• Full unit suite: 2597/2597 green; oxlint + oxfmt clean.

Device verification (iOS, iPhone 16 Pro simulator)

• The exact failing call from the issue — device_batch [{action:'press', testID:'wizard-title-input'}] — now passes (was: STALE_REF @@e68 100% repro).
• Layout-drift scenario: tap that collapses the keyboard re-indexes the whole tree (wizard-next-btn @e101 → @e48); the follow-up testID press re-resolves to the new ref and lands. No STALE_REF anywhere.
• Bonus confirmation: the Phase 2: in-runner keyboard-occlusion guard for live device_* taps (#356 follow-on) #370 keyboard guard refused a genuinely-occluded tap at the correct freshly-resolved coordinates, showing resolution feeds real per-step geometry.
• Android emulator not connected this session; the GH Test coverage gap: agent-device dispatch tiers (fast-runner / daemon / CLI) under realistic envelope shapes #114 parity test pins the identical Android envelope shape (same @-prefixed flat nodes), so the fix applies symmetrically.

Closes #396

🤖 Generated with Claude Code