Or we could look at how it communicates in-circuit, since that matters more than what it looks like to the eyeballs.

Most/all phones have one cell and therefore no balancing magic. Two connections do the job of connecting to the battery cell to the rest of the phone. These two are easily identified with a DMM.

If the phone works with only these two connections, then we're done; the phone will run from a bench power supply and there's nothing left to pursue.

If it does not work, then the functions of any additional connections be further explored while still never unwrapping the battery. Serial data? NTC thermistor? Something else? Fine; record that and emulate it. NTCs are cheap and so are MCU dev kits. (And if we don't have a decent-ish oscilloscope yet, then this is a good excuse to get one.)