Restore iOS Nimbus enrollment integration test

[jaredlockhart]

The Firefox iOS Nimbus enrollment integration test rotted the same way the Fenix one did: the CircleCI scaffolding is gone (no .circleci/config.yml on main), no GitHub Actions workflow replaced it, and the Python harness at experimenter/tests/integration/nimbus/ios/ has been dormant since. Without live CI coverage, changes to the recipe JSON contract on either side (Experimenter emission or Firefox iOS consumption) can regress silently.

This is the iOS counterpart to #15340 / #15345.

Scope

Restore a minimal end-to-end iOS enrollment integration test that runs in GitHub Actions:

• Runs on a macos-14 (or similar) runner with Xcode + iOS Simulator.
• Checks out mozilla-mobile/firefox-ios at a SHA pinned via experimenter/tests/firefox_ios_build.env.
• Runs xcodebuild build-for-testing to produce a simulator .app bundle. Building from source in-CI is the naive starting point — there is no public prebuilt simulator artifact for firefox-ios (unlike Fenix, which we pull from TaskCluster). If build time becomes an issue we can revisit via a scheduled prebuild job + actions/cache keyed on the pinned SHA.
• Brings up the Experimenter stack the same way fenix-integration-test.yml does.
• Uses helpers.create_experiment + /nimbus/{slug}/draft-to-preview/ to mint a recipe, then fetches from /api/v6/experiments/{slug}/ for the bucket-allocated recipe JSON.
• Boots an iOS Simulator, installs the .app, and invokes nimbus-cli --app firefox_ios --channel developer enroll ... --preserve-targeting --preserve-bucketing --reset-app.
• Verifies enrollment via nimbus-cli log-state + simulator log inspection (xcrun simctl spawn booted log show ...), mirroring the Fenix logcat-grep pattern.
• Adds a firefox-ios entry to .github/workflows/update-firefox.yml so the pinned SHA is bumped daily.

What this exercises

Same as the Fenix test: recipe JSON schema on both sides, feature-manifest parsing, JEXL targeting, bucketing, Nimbus SDK enrollment state, feature-conflict checks.

Out of scope

Remote Settings HTTP fetch, Autograph signature verification, Kinto approve flow — same exclusions as the Fenix test.

Related

• Fenix integration test: feat(nimbus): add Fenix end-to-end enrollment integration test #15345 (reference implementation)
• Fenix issue: feat(nimbus): Add Fenix end-to-end Nimbus enrollment integration test #15340

┆Issue is synchronized with this Jira Task