PR5: Packet ownership and copy reduction

[mrmidi]

Summary

Reduces packet ownership overhead on the iOS Network Extension hot path.

• Reserves native outbound queue capacity before allocating and copying packet bytes.
• Transfers inbound native packet ownership to Swift Data without a native-to-Swift payload copy.
• Delivers inbound packets in ordered batches and writes each batch through one NEPacketTunnelFlow.writePackets call.
• Keeps YAFF's move-only serialized frame buffer alive through async_write, removing the final frame-vector copy.
• Exposes copy and packet-lease counters to Swift diagnostics.

Baseline

• M7 baseline: e121b237b5ca3659daf13c663f67a05990b64db5
• fptn submodule: f6569b3eaccbdb01527699a7117f5e72faea3a81

Validation

• iOS Simulator Debug build succeeds.
• FptnSelectionCLI Debug build succeeds.
• CLI selection simulation succeeds.
• Added a native GTest fixture for deterministic byte equality between owned and legacy YAFF serialization.
• Fresh GitHub Actions runs are in progress after rebasing onto master.

Scope

Only the iOS tunnel hot path, native submodule, and CLI validation are in scope. No selection, startup IPC, reconnect, or tvOS/macOS feature work is included.