fix: install Apple Watch companions through an RSD tunnel

[Rzbck]

Summary

Rebases the Apple Watch companion sideloading work from #20 onto the current main branch.

The previous PR was based on the now-deleted apple-codesign-quick branch. This keeps the current upstream architecture while restoring the Watch companion support and RSD installation path.

Changes

• discover embedded Apple Watch applications under Watch/*.app
• rewrite Watch bundle identifiers and WKCompanionAppBundleIdentifier
• provision iOS and watchOS App IDs separately
• register paired Apple Watch devices for development provisioning
• request watchOS-specific provisioning profiles
• sign embedded Watch application content
• install Watch companions through companion_proxy and streaming_zip_conduit
• keep Watch companion installation on the existing RemotePairing/RSD tunnel
• retry non-destructive Watch updates when the install coordinator is temporarily busy
• preserve current main callback and signing architecture

Validation

• rebased on current upstream main
• branch is not behind upstream main
• diff is limited to Apple Watch companion support
• previous implementation was physically validated on Windows with an iPhone running iOS 27.0 and an Apple Watch Ultra 1 running watchOS 26.6 through the Network/RSD transport
• the previous extracted implementation passed cargo check -p isideload and cargo test --locked -p isideload --lib
• this rebased branch has not yet been separately re-tested on physical hardware

Scope

This PR is limited to embedded Apple Watch companion applications and the associated RSD installation path.

It does not claim support for independent Watch-only applications or all possible entitlement and nested-bundle configurations.

Continuation of #20.