Fix frame capture callback lifetime

[sjchmiela]

Summary

• retain SimulatorKit screen callback blocks for the full registration lifetime
• clear retained callback blocks only after unregistering callbacks
• serialize frame-capture teardown on the capture queue so pending callbacks drain before native capture state is released

Root cause

A local npx @expo/serve-sim crash report showed SIGBUS on the frame-capture queue in serve-sim-native.node, symbolicated through FrameCapture.captureFrame() and FrameCapture.registerFrameCallbacks(desc:). The callback blocks were local Swift values passed through objc_msgSend; this keeps explicit strong references to them while SimulatorKit callbacks are registered.

Validation

• npm exec --yes --package bun@latest -- bun run packages/serve-sim/build.ts
• ./node_modules/.bin/tsc --noEmit

I did not live-test against a booted simulator because none were booted when validating this change.