[Bug]: Device Hub opens for stable Xcode when Xcode 27 beta is co-installed

### Bug Description

When Xcode 26 stable and Xcode 27 beta are installed together, XcodeBuildMCP
2.7.0 opens the beta-only Device Hub even when `DEVELOPER_DIR` explicitly
selects stable Xcode and the target is an iOS 26.5 simulator.

This crosses the selected toolchain boundary. Stable Xcode 26 ships
`Simulator.app`; Device Hub is bundled only inside Xcode 27 beta on this host.

The cause appears to be the frontend candidate order in
[`focus-policy.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/v2.7.0/src/utils/focus-policy.ts#L67-L88):
the Device Hub candidate is attempted first for every non-headless simulator
launch—via `devices://` when a simulator ID is known, or `open -a DeviceHub`
otherwise—without consulting the active Xcode selected by `DEVELOPER_DIR`.
Simulator.app is only a fallback if opening Device Hub fails. `build_run_sim`
[invokes this policy automatically after boot](https://github.com/getsentry/XcodeBuildMCP/blob/e6ef59b49b44012c824f0a0de261c96142e37390/src/mcp/tools/simulator/build_run_sim.ts#L378-L388).
The same behavior is still present on `main` as of 2026-08-10.

### Debug Output

```text
Platform: macOS 26.5.2 (25F84), arm64
Stable Xcode: 26.6 (17F113)
Beta Xcode: 27.0 (27A5237l)
Selected DEVELOPER_DIR: /Applications/Xcode.app/Contents/Developer
XcodeBuildMCP: 2.7.0
Codex CLI: 0.144.1

Stable frontend:
/Applications/Xcode.app/Contents/Developer/Applications/Simulator.app
bundle id: com.apple.iphonesimulator

Beta frontend:
/Applications/Xcode-beta.app/Contents/Applications/DeviceHub.app
bundle id: com.apple.dt.Devices

Target simulator:
iPhone 17 Pro, iOS 26.5

Control result with XCODEBUILDMCP_HEADLESS_LAUNCH=1:
build-and-run SUCCEEDED on the iOS 26.5 simulator
app launched successfully
no DevicesTrampoline process was created
```

### Editor/Client

Codex desktop with Codex CLI 0.144.1

### MCP Server Version

2.7.0

### LLM

GPT-5 Codex

### MCP Configuration

```toml
[mcp_servers.xcodebuildmcp]
command = "npx"
args = ["-y", "xcodebuildmcp@2.7.0", "mcp"]
env = {
DEVELOPER_DIR = "/Applications/Xcode.app/Contents/Developer",
XCODEBUILDMCP_ENABLED_WORKFLOWS = "simulator,ui-automation,debugging,logging",
}
```

### Steps to Reproduce

1. Install Xcode 26 stable at `/Applications/Xcode.app`.
2. Install Xcode 27 beta at `/Applications/Xcode-beta.app`.
3. Set `DEVELOPER_DIR=/Applications/Xcode.app/Contents/Developer`.
4. Leave `XCODEBUILDMCP_HEADLESS_LAUNCH` unset.
5. Select an available iOS 26.5 simulator by UDID.
6. Run `open_sim` or `build_run_sim`.
7. Observe that Device Hub from Xcode 27 beta opens instead of Simulator.app
from the selected stable Xcode.

### Expected Behavior

In automatic GUI mode, the active Apple toolchain should own the simulator
frontend:

- Xcode 26 stable selected -> Simulator.app
- Xcode 27 selected -> Device Hub

An explicit `auto | simulator | device-hub` preference would also work, with
`auto` derived from the Xcode selected by `DEVELOPER_DIR` rather than from the
machine-wide `devices://` URL handler.

Headless mode should continue to suppress both frontends.

### Actual Behavior

For every non-headless launch, XcodeBuildMCP tries Device Hub first. Because the
Xcode 27 beta installation registers `devices://`, that succeeds even though
stable Xcode is selected, so Simulator.app is never attempted.

### Error Messages

No command error is emitted; the wrong GUI frontend opens successfully.

### Related

#498 covers the separate but complementary problem of selecting the newest
simulator runtime within a stable OS major when a next-major beta is installed.

Start in src/utils/focus-policy.ts at the frontend candidate order, then trace how src/mcp/tools/simulator/build_run_sim.ts invokes the policy after boot. Reproduce with stable and beta Xcode installed and DEVELOPER_DIR selecting stable; done means automatic GUI launches the frontend owned by the selected Xcode, while headless mode still opens neither frontend.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.