Support iOS and macOS applications (Mach-O)

[greeng3]

Blutter reads Android libapp.so. This teaches it to read the Mach-O images an
iOS or macOS Flutter application ships — App.framework/App alongside
Flutter.framework/Flutter or FlutterMacOS.framework/…/FlutterMacOS.

Validated on two real applications:

	iOS	macOS
sample	a shipped iOS app, Dart 3.10.7, arm64	AppFlowy 0.13.1 universal, Dart 3.11.5, arm64
disassembly files	424	4482
analysis errors	0	2

The two macOS errors are pre-existing arm64 matcher gaps (a cbnz fallthrough
where a branch is expected, and two thread-offset loads before a blr) with
nothing platform-specific about them.

The loader

MachOHelper locates the four snapshot symbols in LC_SYMTAB and lays the
segments out at their virtual addresses rather than mapping the file flat.
That detail is load-bearing: App's __DATA is zero-fill and its vmaddr range
overlaps __LINKEDIT under a flat mapping, and the VM writes into that BSS
while loading the snapshot.

Mach-O structures are declared locally rather than taken from
<platform/mach_o.h>, which only exists in recent SDKs. DartApp dispatches on
the file magic. Universal binaries are supported, preferring the arm64 slice; a
64-bit fat header is rejected with a clear message rather than misparsed, since
its slice entries are 32 bytes rather than 20.

The analyzer

iOS and macOS do not use compressed pointers, and the arm64 analyzer assumed
throughout that they were in use. Every crash and all 903 initial analysis
errors on the iOS sample traced back to that one assumption.

The matchers now handle both representations: isSmiScaledOperand() for the
sxtw-vs-lsl scaling of a Smi index, isSmiUntagToNative() for the sbfx-vs-asr
untag, the static field offset divided by kWordSize / kCompressedWordSize
rather than shifted by one, and the args-descriptor element read at
Array::data_offset() rather than a hardcoded two pointers. CSREG_DART_HEAP
loses a DART_COMPRESSED_POINTERS guard it could never have honoured, since
CodeAnalyzer_arm64.cpp refers to the register unconditionally. DartClass
stops reading a class id out of the null pointer for Object, which has no
super class — uncompressed, that garbage reads back negative and the old
superCid > 0 guard never fired.

These changes touch code shared with the Android path, so they were
validated against a compressed build: the same Android libapp.so through the
pre-change and post-change binaries produces byte-identical output — all
1800 asm files, objs.txt, pp.txt and the IDA scripts — with 0 analysis
errors on both sides.

One caution for anyone repeating that: a raw diff shows 257 of 1800 files
differing, and it is noise. Blutter prints host addresses of its own process
into its output, in hex and in decimal, so running the same binary twice
reproduces the same 257-file diff. Run that control first.

Build and detection

scripts/CMakeLists.txt defines what a real Dart build of each target defines —
android DART_TARGET_OS_ANDROID, ios DART_TARGET_OS_MACOS and
DART_TARGET_OS_MACOS_IOS, macos DART_TARGET_OS_MACOS alone. Defining only
the _IOS sub-flag does not compile, because Dart::VersionString() tests the
parent flag first; defining it for a desktop target takes iOS code paths.

extract_dart_info.py parses Mach-O, so the Dart version and target are
detected without --dart-version. The target is read from the image — the
header names the architecture, LC_BUILD_VERSION names the platform — rather
than from the embedded version string, because a universal binary carries one
string per slice and beta/dev engines may carry none at all. When the version
string is absent, the engine ids are looked up against the Flutter SDK archive,
matching what the ELF path already did. A macOS engine embeds those ids; an iOS
engine does not, so that case now fails with an actionable message naming
--dart-version instead of an assertion.

Tests

A tests/ directory, standard library only, no test framework introduced: 48
tests run with python -m unittest discover -s tests. Roughly half need nothing
but requests and pyelftools; the rest opt in to a built binary or a sample
application via environment variables and skip cleanly without them.
BLUTTER_TESTS_STRICT=1 turns a missing dependency into a failure rather than a
skip, so a runner cannot report success over a suite that did not execute.

Universal-binary fixtures are synthesized rather than committed — a real one is
hundreds of megabytes of third-party software — but the loader test wraps a
real thin App in a fat container with a stub slice placed first and
requires the analysis to match the thin run line for line, so the synthetic
container is checked against genuine Mach-O content.

Known follow-ups, not addressed here

• Fixed-offset String element accesses take their index from the TypedData
  payload base, giving a wrong (negative) index on a small number of accesses.
  A String byte read and a TypedData byte read are indistinguishable from the
  displacement alone, so this needs a String entry in ArrayOp::ArrayType
  rather than another constant.
• The two arm64 matcher gaps above.

---

Opened as a draft to keep it tracked, not to ask for review yet.

Independent of #214 and #215 — this branch sits directly on main and applies
without either of them, so all three can be taken in any order, or separately.