Implement private CoreSimulator boot path and direct display attach

[DjDeveloperr]

Summary

• Boot simulators through private CoreSimulator APIs with an explicit developer-dir lookup and persist: YES boot options.
• Remove the xcrun simctl boot fallback so boot failures surface as clear private-CoreSimulator errors instead of launching Simulator.app.
• Update the display bridge to resolve the active Xcode developer directory consistently and prefer direct CoreSimulator screen IOSurface callbacks before the SimulatorKit fallback.
• Move stream startup onto an entered Tokio runtime before subscribing to frames to avoid early callback issues.
• Refresh README and docs to match the new boot and display behavior.

Testing

• npm run build:cli
• simdeck boot <udid> against an already booted simulator
• simdeck stream <udid> --frames 1 to verify a non-empty H.264 sample is produced