iOS Simulator live panel helper (claude-ios-sim) crash-loops in Metal/CoreImage on macOS 27.0 beta

## Summary

The iOS Simulator live panel helper (`claude-ios-sim`, bundled with the Claude desktop app at `/Applications/Claude.app/Contents/Helpers/Claude iOS Sim.app`) crashes with SIGABRT immediately on every `attach`, on macOS 27.0 beta. The crash is an uncaught NSException thrown inside Apple's Metal framework while CoreImage loads a precompiled Metal binary archive — so this looks like a macOS 27 beta framework incompatibility rather than app logic, but the helper has no guard around it and dies every time, making the live panel unusable on the OS beta.

The simulator itself is healthy: `simctl` boot/screenshot/io all work, and headless verification through the MCP tool works between crashes. Only the panel helper dies.

## Environment

- macOS 27.0 beta (build `26A5421a`), Apple Silicon (Mac16,8)
- Claude desktop app 1.40609.0, Claude Code 2.1.220
- Xcode 27.0 beta (27A5209h), iOS 27.0 simulator runtime (24A5370g)
- Booted device: iPhone 17 (iOS 27.0)

## Steps to reproduce

1. Run macOS 27.0 beta with Xcode 27 beta selected (`xcode-select` → Xcode-beta.app), iOS 27.0 runtime installed.
2. Boot any iOS 27.0 simulator (`xcrun simctl boot `).
3. Call the iOS Simulator MCP tool with `action: "attach"` (or otherwise open the live panel).
4. The tool reports "Simulator panel opened", but `claude-ios-sim` aborts within seconds. Subsequent `screenshot` calls return "Claude Code iOS Simulator is restarting after a crash."

Reproduced 6 times in a row (six `.ips` reports within two minutes). Clearing the per-user Metal shader caches (`$(getconf DARWIN_USER_CACHE_DIR)/com.apple.metal{,fe}`) does not help.

## Crash details

`EXC_CRASH (SIGABRT)`, `abort() called`, uncaught NSException. Last exception backtrace (from the `.ips` report):

```
CoreFoundation __exceptionPreprocess
libobjc.A.dylib objc_exception_throw
CoreFoundation -[__NSPlaceholderArray initWithObjects:count:]
CoreFoundation +[NSArray arrayWithObjects:count:]
Metal __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
libdispatch.dylib _dispatch_client_callout
libdispatch.dylib _dispatch_once_callout
Metal -[_MTLDevice recordBinaryArchiveUsage:]
Metal -[_MTLBinaryArchive loadFromURL:error:]
Metal -[_MTLBinaryArchive initWithOptions:device:url:error:]
CoreImage +[CIKernelLibrary(Internal) internalBinaryArchiveWithName:device:]
CoreImage CI::PrecompiledUberFunctions::PrecompiledUberFunctions(CI::MetalContext const*)
```

`recordBinaryArchiveUsage:` builds an `NSArray` with a nil element while CoreImage initializes its precompiled uber-function archive. Full `.ips` crash reports available on request (they carry device identifiers, so not pasting them wholesale here).

## Expected

Either the panel renders, or the helper catches the failure and degrades gracefully (e.g. panel reports "rendering unavailable on this OS" while headless screenshot/input keeps working) instead of crash-looping.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Start by reproducing the attach flow with the stated macOS, Xcode, and iOS simulator versions, then inspect the `.ips` reports for the CoreImage/Metal failure. The issue identifies the bundled helper at `/Applications/Claude.app/Contents/Helpers/Claude iOS Sim.app` but no repository source or test; determine where that helper is implemented and whether graceful degradation can be verified without breaking `simctl` or headless MCP operations.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.