AltJIT iPadOS 26.x: depends on system python/pymobiledevice3; causes mounter/start-tunnel/LibreSSL and dynamic RSD port failures

Environment

• macOS 26.3 (25D125)
• AltServer 1.7.2 (build 90) with bundled altjit
• iPadOS 26.2.1 (23C71)

Problem
AltJIT on iPadOS 26.x is very sensitive to whatever python3 + pymobiledevice3 the user has installed, which causes multiple failure modes:

1. Developer Disk mount step

• altjit: "Mounting personalized developer disk..."
• then fails with: Error: No such command 'mounter'

2. Tunnel creation / connection

• QUIC tunnel often fails (qh3/ConnectionError/QUIC protocol errors).
• A TCP fallback is needed, but can fail depending on the user environment:
  • older pymobiledevice3: no remote start-tunnel command
  • macOS Command Line Tools python uses LibreSSL; TCP tunnel can fail with:
    • SSLError: ('No cipher can be selected.',) (PSK cipher)

3. iPadOS 26.x RemoteXPC RSD port is dynamic

• bonjour _remoted._tcp advertises a port that changes (examples observed: 60048, 60071, 60085...).
• Any codepath that assumes 58783 will intermittently fail.

Example observation (redacted):

• python3 -m pymobiledevice3 remote browse --no-color shows port 60085 on iPadOS 26.2.1 (varies per run/device).

Expected

• The official AltStore Classic JIT flow should be stable on current iPadOS versions without requiring users to debug Python/SSL dependency drift.

Suggested fix

• Bundle and pin a known-good tunnel/mounter implementation (e.g. ship a pinned python runtime with OpenSSL + compatible pymobiledevice3, or implement the tunnel/mounter logic inside AltServer).
• At minimum, add version/feature detection and show an actionable error message (required python/pymobiledevice3 versions, OpenSSL requirement, etc.).

Start by reproducing the AltJIT flow on the listed macOS and iPadOS versions, using python3 -m pymobiledevice3 remote browse --no-color to inspect the advertised RSD port. Investigate the mounter, tunnel, and dynamic-port failure paths; done means the official JIT flow works without dependency drift or reports actionable version and OpenSSL requirements.