[FEATURE] Scoped, owner-approved test-account sign-in for dev/QA (domains, iOS Simulator/Device Hub, native apps) without the model seeing credentials

Summary

Let the owner pre-approve Claude to sign in on specific domains, apps and simulators for dev/QA testing, using credentials Claude never sees. Today Claude correctly refuses to type passwords, but there is no approved path for the most common agentic-dev case: logging into your own staging/test environment with a test account to verify a change. So QA runs stall at every login screen, and simulators are the worst case.

Current behavior (Claude desktop app, Code tab, Claude Code 2.1.282, macOS 27.2)

• Claude will not enter a password to authenticate, even for a seeded staging test account on the owner's own domain, even with explicit owner permission. That boundary makes sense as a default.
• The one approved route, 1Password autofill through Claude in Chrome, only works in the owner's Chrome. It can't reach:
• iOS simulators in Xcode 27 Device Hub, whether in Safari or a native app
• Native app sign-in screens, e.g. a WKWebView app wrapper under test
• Physical test devices driven through Device Hub
• Headless or background subagents, where there's no one to approve a prompt
• Result: each verification pass (after a simulator restart, app reinstall, or new test device) needs a human to walk over and type the password, then hand control back. For agent-driven QA that's the main bottleneck. We see it daily.

What we're asking for

An owner-configured, scoped test-credential allowlist in settings (user or managed), for example:

"testCredentials": [
  {
    "match": { "domains": ["staging.example.com"], "iosBundleIds": ["com.example.app.staging"], "simulators": true },
    "credentialRef": "op://Dev/Staging test user",   // resolved by the host / password manager
    "fillOnly": true                                 // value typed into the field; never enters model context or logs
  }
]

Requirements:

1. Model never sees the value. The host fills it straight into the focused field, the same guarantee as the 1Password Chrome flow.
2. Scoped: only the listed domains, bundle IDs, simulators or devices, and only for accounts the owner marked as test accounts. A phishing lookalike domain or production must not match.
3. Works where QA happens: Chrome, the built-in browser pane, the iOS Simulator and Device Hub (keyboard injection into the focused field), and native app sign-in screens.
4. Works unattended: pre-approval covers background agents and CI-style runs without a per-fill prompt. Still auditable, e.g. a log line recording "filled test credential X into Y".
5. Owner-only: this can't be enabled from project files, web content or tool output.

Why

Agentic coding now includes verifying changes end to end on real screens, and nearly every app worth testing is behind a login. Without a sanctioned, scoped way to sign into test accounts, teams either give up on agent QA or look for workarounds, like test-only login bypasses in their apps, that are less safe than a proper credential broker.

Related: #88165 (general credential broker; this is its dev/QA-scoped version), #96941 (Device Hub simulator panel orientation/fold bug found during the same QA work).