iOS Simulator helper crashes in CoreImage/Metal on macOS 27, making tap/swipe unavailable

### What happens

The bundled iOS Simulator helper (`Claude iOS Sim.app` / `claude-ios-sim`) crashes
deterministically on macOS 27 as soon as it captures a frame. `attach` succeeds and
returns the coordinate space, but the very next `screenshot` or `tap` aborts the
helper. After a few attempts the session gives up with:

> Claude Code iOS Simulator has stopped retrying after repeated crashes. Retrying
> will not help; ask the user to re-open the simulator panel.

Re-opening the panel does not help — it crashes again the same way. The net effect
is that **tap/swipe/type are completely unavailable**, so the agent cannot drive a
simulator at all. The panel is left blank/white, which looks like the app under
test has hung when it has not.

### Environment

- Claude Desktop 1.52386.6
- macOS 27.0 (26A428), Apple silicon
- Xcode 27.0 (27A266a)
- iOS 26.5 simulator (also reproduced with iOS 27.0 booted)

### Crash

`EXC_CRASH (SIGABRT)`, from an Objective-C exception thrown during CoreImage's
Metal context setup. Identical stack in **22 crash reports** in one day:

```
libsystem_kernel.dylib __pthread_kill
libsystem_c.dylib abort
libc++abi.dylib demangling_terminate_handler()
libobjc.A.dylib _objc_terminate()
libc++abi.dylib __cxa_throw
libobjc.A.dylib objc_exception_throw
CoreFoundation -[__NSPlaceholderArray initWithObjects:count:]
CoreFoundation +[NSArray arrayWithObjects:count:]
Metal __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
libdispatch.dylib _dispatch_once_callout
Metal -[_MTLDevice recordBinaryArchiveUsage:]
Metal -[_MTLBinaryArchive loadFromURL:error:]
Metal -[_MTLBinaryArchive initWithOptions:device:url:error:]
CoreImage +[CIKernelLibrary(Internal) internalBinaryArchiveWithName:device:]
CoreImage CI::PrecompiledUberFunctions::PrecompiledUberFunctions(CI::MetalContext const*)
CoreImage CI::new_uber_functions(CI::MetalContext const*)
CoreImage CI::MetalContext::init(id, char const*)
```

Thread: `com.apple.root.default-qos.cooperative`. Reports are at
`~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips`.

### Notes from narrowing it down

- **Not the Xcode 27 rename.** Simulator.app is now Device Hub on this release, but
that is a different code path — `simctl` works throughout (see below).
- **Not a nil bundle identifier.** That is the usual cause of a nil reaching
`+[NSArray arrayWithObjects:count:]`, but the helper bundle has a valid
`CFBundleIdentifier` (`com.anthropic.claude.ios-sim`).
- **Possible lead, unconfirmed:** the helper's sandbox profile
(`Claude.app/Contents/Resources/claude-ios-sim.sb`) grants `file-write*` only to
the CoreSimulator home, CoreSimulator logs, `DARWIN_TMP` and `/private/var/tmp`.
It does not grant the Darwin **cache** directory, which is where
`com.apple.metal` lives. If `recordBinaryArchiveUsage:` writes there, a denial
could explain a nil reaching that array. I did not verify this — `(deny default)`
denies silently, so nothing appears in the sandbox log either way.

### Workaround

`xcrun simctl` is unaffected — `list`, `boot`, `install`, `launch`, `terminate` and
`io screenshot` all work normally, so screenshots remain possible. There is
no substitute for tap/swipe: `simctl` has no tap, and `devicectl` has no tap
subcommand.

Start with the bundled claude-ios-sim helper, the crash reports in ~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips, and Claude.app/Contents/Resources/claude-ios-sim.sb. Reproduce the failure with screenshot or tap after attach, then investigate the CoreImage/Metal crash and sandbox profile. Done means the helper captures frames without crashing and tap, swipe, and type work again on the affected macOS and iOS Simulator versions.

Written by the indexing model from the issue text.