docs: record verified PWA design preview and recovered Apple validation

docs/validation.md

@@ -34,8 +34,62 @@ Logs: `/home/neste/yuvomi-design-build-final.log`,
 `/home/neste/yuvomi-design-secure-final.log`.
 The [design comparison](native-design.md) includes reviewed synthetic images and
 documents the exact 360 × 592 content viewport and intentional fixture scope.
-**This is not accepted 1:1 parity.** iOS was not changed or newly validated.
-Remote KVM/CoreSimulator prerequisites and production signing remain open.
+**This is not accepted 1:1 parity.** iOS was not changed in this design pass.
+Remote Android KVM prerequisites and production signing remain open. The earlier
+Mac blocker has since cleared, as verified below.
+
+A separate `git archive` checkout of committed source `7ac9882` was rebuilt at
+`/tmp/opencode/yuvomi-design-clean-1fknxqpt`, with outputs under
+`/home/neste/yuvomi-design-clean-build-7ac9882`. JVM tests, both lint variants and
+debug/unsigned release APK/AAB builds succeeded (`/home/neste/yuvomi-design-clean-build.log`).
+The artifact collector verified version/code, debug signature, unsigned release
+outputs, production TLS-only/system-CA policy and absence of test certificates or
+private signing files. Local copies are in ignored `artifacts/android/`. Collection
+records the documentation-only dirty worktree honestly; the build itself used the
+clean committed-source archive, not those later documentation edits.
+
+### Downloaded and installed CI artifact
+
+Gitea Android run **670**, build job **1079**, source `7ac9882`: the build/test/lint,
+repository/script/format/dependency checks and artifact upload succeeded. The
+actual ZIP was downloaded; its sole `app-debug.apk` is
+`0.2.2-native-preview` / code **4**, and `apksigner` verified its signature. No
+fixture certificate or private signing files were present. The downloaded APK was
+then installed and cold-launched successfully on authorized `emulator-5554`.
+
+- [Download Android 0.2.2 native preview](https://git.nesterovic.cc/nessi/Yuvomi-App/actions/runs/670/artifacts/android-native-debug-apk)
+- APK SHA-256: `6efea6c2fbafc0702f6cd8c665817dd93a1d63590b00da4def09d246df900e44`
+- Local downloaded copy/verification: ignored `artifacts/android-ci-670/`.
+- The CI debug certificate differs from the local development certificate. Only
+  the known synthetic local preview was removed for this installation. A user
+  whose older preview has a different debug certificate may need to uninstall it
+  before installing this APK and then log in again; server data is not deleted.
+
+The whole Android run is **not green**: emulator jobs **1080/1081** failed preflight
+because `/dev/kvm` is not exposed/read-write accessible inside their jobs. Their
+logs explicitly report this prerequisite; no remote emulator pass is claimed.
+All device-test results above are the actual local API-35 executions.
+
+### Verified Apple runner recovery
+
+Inspection of Gitea run 669/job 1078 at `bd0e4cc` found an actual successful Apple
+run, not just green bootstrap steps. The downloaded job log contains:
+
+- Successful bounded `simctl` preflight and native app simulator compilation.
+- 16 portable tests, then 16 simulator XCTest tests with zero failures.
+- One `OnboardingTests.testRejectsCleartextWithoutNetwork` UI test, zero failures;
+  it checks cleartext rejection and absence of a WebView in the native hierarchy.
+- `** TEST SUCCEEDED **` and `** ARCHIVE SUCCEEDED **` for the explicitly unsigned
+  generic-iOS device archive.
+
+Log retained outside Git: `/home/neste/yuvomi-ios-job-1078.log`. This supersedes the
+earlier CoreSimulator timeout as a **current** blocker, while leaving its historical
+diagnosis intact. It is not a native login/CRUD, Keychain runtime, real-device or
+visual-parity certification, nor an installable signed iOS distribution.
+The current design source `7ac9882` also completed the same Apple checks in run
+671/job 1082. Its downloaded log again contains the 16-test XCTest and one-test
+onboarding successes plus `TEST SUCCEEDED` / `ARCHIVE SUCCEEDED` markers
+(`/home/neste/yuvomi-ios-job-1082.log`). The iOS UI itself is unchanged.
 
 ## Android 0.2.1 / code 3: reproduced login regression
 
@@ -147,9 +201,11 @@ Evidence paths in the local external build directory:
   passed. The runner administrator must repair CoreSimulator availability for the
   runner user before Apple application validation can proceed.
 
-No Apple SDK application build, simulator UI test or physical-device result is
-claimed from the Linux runs or the stalled Mac job. Runner prerequisites were
-not weakened or counted as passing, and no host license/settings were changed.
+At that point no Apple SDK application build or simulator UI result was available
+from the Linux runs or stalled Mac job. The later verified run 669 above supersedes
+that limitation for compilation/basic simulator tests/archive only. No physical-
+device result is claimed. Runner prerequisites were not weakened, and this agent
+did not change host license/settings.
 
 ## Commands
 
@@ -170,7 +226,7 @@ devices are not test targets.
 
 ## External gates
 
-Apple SDK builds, real supported devices/current engines, Android API 37, native
+Broad Apple UI/runtime coverage, real supported devices, Android API 37, native
 SSO/reset/invite protocols, permission/role cases, files/offline/notifications,
 complete module and settings parity, visual baselines, accessibility and human
 security review remain open. Missing modules are listed in