iOS Simulator panel: claude-ios-sim crashes (SIGABRT) on attach via CoreImage Metal binary archive

## Summary

The `claude-ios-sim` helper bundled in Claude.app crashes with `SIGABRT` every time a simulator is attached, so the iOS Simulator panel never opens. Selecting a device on the "attach a simulator" screen bounces straight back to that same screen.

Crashed 7 times in a row today, identical signature each time. The MCP tool reports `Claude Code iOS Simulator is restarting after a crash. Try again in 1s.` on every subsequent call.

## Root cause (from the crash report)

An unhandled Objective-C exception while **CoreImage** loads a precompiled Metal binary archive. `_MTLBinaryArchive loadFromURL:` ends up passing `nil` into `+[NSArray arrayWithObjects:count:]`, which throws, and the helper has no handler, so it aborts.

```
9 libobjc.A.dylib objc_exception_throw
10 CoreFoundation -[__NSPlaceholderArray initWithObjects:count:]
11 CoreFoundation +[NSArray arrayWithObjects:count:]
12 Metal __39-[_MTLDevice recordBinaryArchiveUsage:]_block_invoke
13 libdispatch _dispatch_client_callout
14 libdispatch _dispatch_once_callout
15 Metal -[_MTLDevice recordBinaryArchiveUsage:]
16 Metal -[_MTLBinaryArchive loadFromURL:error:]
17 Metal -[_MTLBinaryArchive initWithOptions:device:url:error:]
18 CoreImage +[CIKernelLibrary(Internal) internalBinaryArchiveWithName:device:]
19 CoreImage CI::PrecompiledUberFunctions::PrecompiledUberFunctions(CI::MetalContext const*)
```

`exception: EXC_CRASH (SIGABRT)`, `termination: Abort trap: 6`, faulting process `claude-ios-sim` (`com.anthropic.claude.ios-sim`).

Note frames 13–15: the throw happens inside a `dispatch_once`. Once that block has thrown, the `once` token stays set, which may explain why every retry after the first fails the same way rather than recovering.

## Environment

- macOS 27.0 (26A428)
- Mac16,8 (Apple Silicon)
- Xcode 27.0 (27A266a)
- Claude.app 1.52386.6
- 4 booted simulators on the machine at the time

## Steps to reproduce

1. Boot an iOS simulator and install a dev-client app on it.
2. Open the iOS Simulator panel in Claude and pick that device (or call the simulator MCP's `attach`).
3. `attach` returns success, then the next call (`screenshot`) fails with the restarting-after-crash message. The panel returns to the device picker.

## What I ruled out

- **Memory.** The app under test had grown to 1.88 GB; restarting it brought that to 980 MB and the crash was byte-for-byte identical. System-wide memory was 67% free throughout.
- **A specific device.** Same crash on attach regardless of which simulator is selected.
- **The simulator itself.** `xcrun simctl io screenshot` and Maestro flows against the same device work fine throughout, so the device and the app on it are healthy — it's only the helper that dies.

## Impact

The live panel is unusable. Driving the simulator via `xcrun simctl` and Maestro still works, so it's a degraded experience rather than a blocker, but screenshots and taps through the Claude panel are unavailable.

Crash reports are at `~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips` if fuller logs would help.

Start with the claude-ios-sim helper and the attach and screenshot MCP entry points; no repository file or test is identified in the report. Inspect the crash reports at ~/Library/Logs/DiagnosticReports/claude-ios-sim-*.ips and reproduce the attach flow, then verify that the simulator panel remains usable without the SIGABRT restart loop.

Written by the indexing model from the issue text.