Test against Valve's own Steam Frame OS from its recovery image

tests/frame-container/frame-image.sh extracts rootfs-A from Valve's Frame
recovery image (steamdeck-images.steamos.cloud/recovery), mounts it read-only
with a throwaway writable layer and starts the image's own sshd, so the iPhone
app can pair with and run its server on the real SteamOS for Frame userland.
Verified: password pairing then key login in the image's sshd log, the power
password check through the image's sudo, status reading SteamOS 0.3.0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/iphone.md

@@ -78,9 +78,10 @@ screenshots, a file upload (checked on the Frame), a background install job, and
 the power password check (a wrong password is refused). The server on the Frame
 exits within seconds of the app closing.
 
-Against a stand-in built on Valve's Holo Core aarch64 base
-([tests/frame-container](../tests/frame-container)), since Valve publishes no
-Frame OS image: pairing with the password (key added with the right
+Against Valve's own Steam Frame OS (SteamOS 0.3.0 build 20260922.5152327, the
+`rootfs-A` partition of the Frame recovery image, run with its own sshd; see
+[tests/frame-container](../tests/frame-container)), and a Holo Core stand-in:
+pairing with the password (key added with the right
 permissions, host key pinned, password stored nowhere), the power password
 check (a wrong or missing password refused; the right one reaches `systemctl`),
 a changed host key refused with "Pair with the Frame again", and a wrong