Bind the companion fixture to a loopback alias in CI

[BunsDev]

Closes #418

The simulator's TCP connects to the fixture on a hosted runner's 192.168.64.x NAT address drop now and then (POSIX 60 on run 38000133677), which is what made the companion check flaky and what #417 could only mitigate. This takes the fixture off that interface.

• companion-fixture takes an optional bind address as its second argument (fixture::bind_address), limited to private IPv4 addresses because the phone's Pairing.parse accepts only those and rejects 127.0.0.1; without one it binds to the LAN address as before. Three unit tests cover accepted, refused and empty requests.
• CI sets CHAT_IOS_FIXTURE_IP=10.255.255.1; the test script adds that alias to lo0 when absent, passes it to the fixture, and removes it on exit. Local runs without the variable are unchanged.
• docs/iphone-companion.md documents the variable.

Governed files are untouched (Cargo.toml, Cargo.lock, lib.rs, ci.yml), so no repin follows.

Verification

Full-flow runs on this branch (ui_flow on), fixture at https://10.255.255.1. Runs 1 and 2 passed; run 3 was cancelled by the workflow's concurrency group when this PR opened on the same branch, not failed, so the UI-flow gate from #417 stays until three green full runs exist (being gathered on main after this merge):

full 1 run 38007579372: success
  artifact iphone-test-results 264525B
Companion fixture answered HTTP 401 at https://10.255.255.1:49185 after 0s.
CompanionFlowTests testPairSendStreamStopAndForget passed (62.596 seconds).
Simulator A522D4C8-852C-4C94-A046-32F272BEEBDC booted and opened the fixture address; warm-up took 28s.
TransportTests testPinnedHTTPSReadsAndRejectsWrongCertificateAndToken passed (0.904 seconds).
Warm-up: the simulator could not open the fixture address within 45s; continuing.
full 2 run 38008541707: success
  artifact iphone-test-results 273814B
Companion fixture answered HTTP 401 at https://10.255.255.1:49183 after 0s.
CompanionFlowTests testPairSendStreamStopAndForget passed (57.854 seconds).
Simulator 2F2EA505-D281-4003-BAE6-9BC1540BF1DF booted and opened the fixture address; warm-up took 70s.
TransportTests testPinnedHTTPSReadsAndRejectsWrongCertificateAndToken passed (0.542 seconds).
full 3 run 38009415199: cancelled (concurrency group, PR opened)
  artifact iphone-test-results 998B
Companion fixture answered HTTP 401 at https://10.255.255.1:49187 after 0s.
Simulator DD1015DA-4BB9-49B5-B385-40A437BE09BC booted and opened the fixture address; warm-up took 76s.

Host gates on Rust 1.95: cargo test --all-features --lib 283 passed, 6 ignored; cargo clippy --all-targets --all-features -D warnings and cargo fmt --check clean; shellcheck on the script.

Note on the warm-up: simctl openurl to a self-signed HTTPS address returns non-zero once Safari refuses the certificate, which the script reports as "could not open … within 45s" even when it took far less; that is Safari, not the network. With the fixture on loopback the warm-up is a formality and can be trimmed later.

🤖 Generated with Claude Code