[Bug]: XPC peer validation uses non-public API xpc_dictionary_get_audit_token, blocking App Store redistribution

### I have done the following

- [x] I have searched the existing issues
- [x] If possible, I've reproduced the issue using the 'main' branch of this project

### Steps to reproduce

1. Build the project (`main`, abff418).
2. `nm -u bin/container-apiserver | grep audit_token`

Output:

```
_xpc_dictionary_get_audit_token
```

The concrete consequence: we redistribute the engine inside a Mac App Store app (re-signed under our own identity), and App Store Connect rejected the upload with:

> The app uses or references the following non-public or deprecated APIs:
> • _xpc_dictionary_get_audit_token
> Revise the binary and remove all references to any non-public or deprecated APIs.

### Problem description

#896 added same-EUID validation of XPC peers by reading each message's audit token. `xpc_dictionary_get_audit_token` is not in the public XPC headers — the `CAuditToken` target exists solely to re-declare its prototype, which is itself the tell.

The check's purpose (client EUID == server EUID) is fully served by public API: for a launchd Mach service, every peer arrives on its own connection, so the connection's credentials and the message sender's are the same identity, and `xpc_connection_get_euid` is the documented way to read them.

We run this replacement in production: same enforcement, and the `CAuditToken` shim target can be deleted entirely. It also unblocks anyone embedding these binaries in an App Store submission. Happy to open a PR.

### Environment

- OS: macOS 26.6 (25G72)
- Xcode: 26.6 (17F113)
- Container: 1.2.0 (present unchanged on main at abff418)

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Start by locating the CAuditToken target and the XPC peer-validation code used by container-apiserver, then inspect the documented xpc_connection_get_euid entry point. Rebuild the project and run nm -u bin/container-apiserver | grep audit_token; done means the non-public symbol and shim are gone while same-EUID validation remains enforced.

Written by the indexing model from the issue text.