[kmagiera]

Summary

CoreDevice can label a forwarded USB connection as localNetwork, even while the phone is exposed as a USB device through usbmuxd. Argent rejects that connection before starting the runner. This accepts forwarded USB while preserving the existing USB-only transport boundary.

• Share the transport check between readiness and list-devices. Accept localNetwork only when the exact UDID has a live ConnectionType: USB entry in usbmuxd. Keep the wired and older-toolchain paths, unknown-transport rejection, connecting-tunnel check and readiness cache.
• Restrict the mux DeviceID lookup to USB entries for both discovery checks and actual runner connections. A Wi-Fi Network entry alone stays unavailable, even when its UDID matches. Remove the fallback from USB to a network entry.
• Update connection hints, tool help, skills and docs to distinguish local USB, forwarded USB and unsupported ordinary Wi-Fi. The runner retains its loopback-only listener.

Wi-Fi support was deliberately removed in the original transport change: its CoreDevice tunnel route was unverified on hardware, could engage silently after a cable disconnect, and added slow device probes. This PR preserves that decision; forwarding a USB transport does not restore the removed direct network route.

Test Plan

• npm run build, npm run typecheck:tests -w @argent/tool-server, and npm run knip against the unbuilt checkout: pass.
• npm test -w @argent/tool-server: 513 files passed; 7,838 tests passed and one skipped. Protocol tests use a local fake daemon; readiness and listing tests mock USB availability. Coverage includes forwarded USB, rejection of a matching Wi-Fi-only entry before a runner connection, missing/unknown connection types, exact UDID matching, stale pairing, unknown CoreDevice transport, connecting tunnels and detach after the readiness cache expires.
• ESLint and Prettier on the changed files, node scripts/grade-skills.mjs, and git diff --check: pass.
• Earlier live checks using this branch's built source refused the previously leased phone's stale localNetwork / disconnected entry when it was absent from usbmuxd. The connection was left untouched.
• Earlier proof of concept against installed Argent 0.27.0 used an iPhone 15 on iOS 18.7.8 with a forwarded usbmux connection (Corellium usbfluxd). It appeared connected; detaching the forwarder changed it to paired and readiness refused it. The connection was restored, and launch-app successfully launched Settings. This preceded the stricter USB-entry filter; that filter has not had a fresh live connected-device check.
• Full runner UI automation remains unverified. Setup was blocked first by the signing team's registered-device quota and later by on-phone developer trust for a Personal Team certificate. No successful screen read or touch was established.