Apple Virtualization.framework: real Swift helper binary

## Description

Per CLAUDE.md "Remaining Stubs" and spec T025-T028: the Apple VF helper binary (`wc-apple-vf-helper`) needs separate macOS compilation. The Rust side (`src/sandbox/apple_vf.rs`) is wired to call a helper binary via subprocess, but the Swift helper itself needs real Virtualization.framework integration.

## Requirements

- Swift binary using Apple Virtualization.framework (VZVirtualMachine API)
- JSON command protocol on stdin/stdout for Rust interop
- Commands: create, start, pause, resume, stop, checkpoint, terminate
- VZVirtualMachineConfiguration with: CPU count, memory size, disk image, network
- macOS 13+ requirement (Virtualization.framework availability)
- No GPU passthrough (not supported by VF as of 2026)

## Success Criteria

- [ ] Swift helper binary compiles on macOS 13+
- [ ] VM creation, start, pause, resume, stop all functional
- [ ] Checkpoint/restore works across sessions
- [ ] Rust integration via subprocess works end-to-end
- [ ] Integration test: boot VM → execute workload → capture output → clean up
- [ ] No host filesystem/credential/peripheral access from guest

## Testing (Principle V)

- Build and run on real macOS hardware (Apple Silicon preferred)
- Boot Linux guest VM → execute SHA-256 workload → verify output
- Pause → resume → verify state preserved
- Checkpoint → terminate → restore → verify continued execution
- Attempt host filesystem access from guest → verify blocked