#2277 feat(ios): productionize Simulator AX snapshot bridge

Summary

Closes #2196.

Adds the private Apple Simulator AX snapshot acquisition facet:

• a bounded, framed native bridge returning typed raw-tree facts;
• one host adapter with lazy atomic build/cache, deadline-aware serialization, target validation, cancellation, diagnostics, crash recovery, and instance-safe lifecycle;
• package, protocol, ownership, and focused regression guards;
• no production routing, public CLI, runner/provider integration, physical-device path, downloaded executable, or new workspace package.

The guest remains Objective-C because #2192 selected idb v1.5.2's Objective-C SimulatorFrameworkBridge shape and the boundary dynamically loads private classes/functions, invokes runtime selectors, and contains NSException failures. Swift would still require an Objective-C shim. The September Python code was spike orchestration only and is not part of production.

Validation

Tested commit: e7b32ca5b80b5d68699f7dd8decd06d64589c20a.

• pnpm check:affected --run: all runnable checks passed, including build, typecheck, lint/format, layering, Fallow, integration, and clean-installed package verification.
• Focused snapshot/package tests: 8 files, 35 tests passed.
• Previous implementation head 7ec3327bf8 passed hosted clean-install bridge preparation and targeted XCTest checks.
• Live disposable iPhone 17 Pro Simulator proof: two independent source instances acquired the same target concurrently, each returned a complete tree, and cleanup left no bridge residue.
• Current-head GitHub checks remain authoritative for native/device lanes.

Scope: 41 touched files, limited to the Simulator snapshot-source facet, its native guest, evidence, packaging, and owning gates.