tor: bound native bootstrap and report proxy death (ENV-3127)

[Jacksper13]

Problem

A Dart timeout cannot stop an in-flight native Arti bootstrap. A stalled startup can therefore retain its Flutter Rust Bridge worker and the serialized lifecycle gate after the caller gives up. After startup, Dart also receives no direct signal if the published SOCKS accept loop exits, so recovery waits for unrelated traffic to fail.

Changes

• add a native 180-second deadline for startup and re-bootstrap
• make native bootstrap cancellation explicit so stop() interrupts an in-flight operation
• tear down partially started Arti tasks after cancellation, timeout, bootstrap failure, or proxy-start failure
• monitor the SOCKS accept loop and publish one typed Dart failure event for an unexpected exit
• distinguish intentional shutdown from proxy failure so normal stop() does not trigger recovery
• regenerate Flutter Rust Bridge bindings, bump the package to 0.2.2, and rebuild the checked-in iOS XCFramework

Stack

This is stacked on #82 and preserves that PR's lifecycle serialization and generation invalidation. The Envoy consumer is a separate PR so the operation that can hang or die owns the deadline and failure signal.

Validation

GitHub Actions run: https://github.com/Foundation-Devices/tor/actions/runs/33867954604

• bridge generation passed with flutter_rust_bridge_codegen 2.11.1
• Rust tests passed, including cancellation, native timeout, expected stop, and unexpected proxy-exit coverage
• Flutter analysis passed
• Apple XCFramework build passed for device and simulator
• framework plists are versioned 0.2.2

Artifact provenance: full release rebuild on GitHub macos-14 with Rust/Cargo 1.98.1 and Flutter 3.44.2. Because the repository does not pin Rust, the checked-in binaries include current toolchain/dependency output; compared with the stacked base, the device slice is 1,064,144 bytes larger and the simulator slice is 2,153,504 bytes larger.

Tracks ENV-3127.