ios: give synthesized text entry back-pressure from the field instead of a fixed characters-per-second bound

Start with the synthesized-first-responder-replacement route and the --agent-device-text-entry-async-value-write fixture, then inspect TextEntryTiming.synthesizedCommitCeiling and the existing lane test. Done means back-pressure prevents truncation, the test ends with the exact value or a typed collision reason, and representative 11-, 60-, and 240-character timings are recorded in the PR.

Purpose

#2904 bounds the synthesized replacement burst at 12 characters/second so a field whose app owns its value can acknowledge it. A fixed pace is a trade, not a fix: the burst's wall clock is now linear in the text at ~83 ms per character, so fill loses throughput on long fields, and an app slower than one character interval still wins the race.

Required behavior

Text entry gets back-pressure from the field instead of a guessed constant: the runner keeps characters queued while the field keeps making progress and slows or stops when it does not, so

• a long fill costs roughly what the app can absorb rather than a fixed 83 ms per character,
• an app whose write-back takes longer than one character interval at the current pace cannot silently truncate the value — the command either completes the text or fails with a typed reason naming the collision,
• no fill reaches the runner's 45 s command budget for text a healthy host could have typed sooner.

Observable completion conditions

• Measured end-to-end fill durations for representative text lengths (11 / 60 / 240 characters) on the same Simulator, before and after, recorded in the PR.
• A lane test on the --agent-device-text-entry-async-value-write fixture with a write-back slower than the shipped character interval (~150 ms), which #2904 documents as still corrupting a burst, ends with either the exact value or the typed collision reason.
• TextEntryTiming.synthesizedCommitCeiling's note about the pace's cost upstream of the ceiling is replaced by whatever the new mechanism owns.

Evidence

iPhone 16 Simulator, iOS 26.2, clean app (no write-back fixture), fill through the synthesized-first-responder-replacement route at 12 characters/second: 11 characters 2.2 s, 60 characters 6.7 s, 150 characters 13.6 s, 240 characters 21.1 s. Delivery completes inside the synthesize call, so the 10 s commit ceiling is not the binding limit; the 45 s command budget is, at roughly 500 characters.

Dependencies

Related: #2903 (the verified element route, same app behaviour, no pace bound at all). Supersedes the fixed constant in #2904 when it lands.