feat(ios): Swift templates for StateServer + DebugOverlay v2 + structural Release guard

StateServer is loopback-only (::1 + 127.0.0.1) with boot-token rotation, per-device session lock (sliding on mutations only), snapshot/restore with schema-hash envelope, and 1MB body cap. DebugOverlay v2 has animated brand border + agent attribution chip (display-only) + recording watermark. Package.swift enforces structural Release-build exclusion via .when(configuration: .debug). Includes Tailscale ACL example doc.

ios-qa/templates/DebugBridgeManager.swift.template

@@ -0,0 +1,46 @@
+// AUTO-GENERATED from gstack/ios-qa/templates/DebugBridgeManager.swift.template
+//
+// Bootstraps StateServer + DebugOverlay on app launch. Reads the codegen
+// output, registers accessors, and starts the listeners. Everything is
+// #if DEBUG-gated; this file does not exist in Release builds.
+
+#if DEBUG
+
+import Foundation
+import SwiftUI
+
+@MainActor
+public final class DebugBridgeManager {
+    public static let shared = DebugBridgeManager()
+
+    public func start(appState: AppState, recording: Bool = false) {
+        // 1. Register the canonical AppState struct + accessor wiring.
+        //    AppStateAccessor.register(_:) is generated by gen-accessors-tool.
+        AppStateAccessor.register(appState)
+
+        // 2. Boot the StateServer.
+        StateServer.shared.start()
+
+        // 3. Install the DebugOverlay window.
+        #if canImport(UIKit)
+        DebugOverlayWindow.shared.install(recording: recording)
+        #endif
+    }
+}
+
+// Placeholder. gen-accessors-tool emits the real `AppStateAccessor` enum next
+// to the app's canonical state struct. Apps that haven't run codegen get a
+// stub that registers no accessors (snapshot is empty, restore returns
+// missing-key for every key).
+@MainActor
+public enum AppStateAccessor {
+    public static var register: (Any) -> Void = { _ in }
+}
+
+// Apps declare their canonical state struct; codegen reads it and emits
+// AppStateAccessor.register. The app's struct must be `@Observable` and
+// must hold all snapshot-eligible state in `@Snapshotable`-marked fields.
+@MainActor
+public protocol AppState: AnyObject {}
+
+#endif // DEBUG