Add Maple Dev as a separate internal TestFlight app

[AnthonyRonning]

Maple Dev gets a separate iOS bundle and internal TestFlight update stream, so installing or automatically updating development builds does not replace production Maple. It uses the existing development auth, billing, and flags services, a distinct icon, a persistent DEV badge, and its own callback scheme.

The new workflow builds every master push and reuses the existing Apple signing environment. It verifies the selected build profile and exact artifact before uploading an internal-testing-only IPA. Production remains the default for the shared build script and its existing workflow is unchanged. Generated Xcode and Cargo changes are restored after packaging.

The shared iOS script removes App Store Connect signing inputs from dependency, frontend, and unsigned-build child environments. It decodes the private key into restrictive temporary storage only for the signed archive/export and removes its owned key on success, failure, and handled signals. Caller-supplied key files remain untouched. The rehearsal wrapper also excludes iOS API credentials from ONNX setup and other platform builds. The signed native build and invoking runner remain trusted; this is not isolated signing infrastructure.

Native Apple sign-in gains an optional, administrator-configured list of exact additional audiences. Existing projects, web audiences, request contracts, and omitted-field update behavior remain compatible; no schema migration is needed. Hosted native sign-in keeps its origin, account, expiry, and one-use checks and binds the app variant into the handoff.

Validation

• Signing-hardening validation: all 348 repository Python tests and the full aarch64-darwin Nix flake check passed. Eight hermetic release-script tests cover both variants, inherited canary environments, key permissions/lifetime, borrowed keys, decode/build/verification failures, failed project restoration, INT/TERM/HUP cleanup, and rehearsal routing. An independent source review found no blockers. These tests use fake build tools and do not establish real Apple signing/export or upload.
• Root flake checks passed on aarch64-darwin; frontend format/lint/typecheck and all 1,011 tests passed; PR web artifact built.
• Native Rust tests passed: 422 passed, 2 ignored. Formatting passed. Strict Clippy stops at the unchanged src/agent.rs:7785 unnecessary_sort_by lint present in the base commit.
• Backend formatting, strict all-target/all-feature Clippy, and tests passed: 717 passed, 31 ignored.
• Disposable database integration passed all 30 selected tests with a loopback-only trust fixture. The canonical SCRAM fixture crashed during OpenSSL/libpq teardown after its first 22 tests passed; that canonical command is not claimed green. No checked-in or live database authentication settings changed.
• Dev app built with Xcode 26.5 and launched on the iOS 26.5 simulator. Inspected bundle/name/callback/profile and visible DEV badge; a synthetic invalid login was rejected and malformed warm/cold callbacks remained unauthenticated. The build uses an inert OAuth-origin fixture, so this is not successful provider-login evidence.
• Production-variant simulator package also built and verified. Both apps coinstalled with distinct icons and data containers; each callback scheme opened its own app. Production showed no DEV badge. The owned simulator was shut down afterward.
• Independent auth and CI/profile source reviews found no actionable issue in their scopes.

Before enabling the channel

Configure the verified development web origin and its existing provider default callbacks, deploy the compatible callback/audience support, and configure/read back the new native Apple audience. The current published SDK does not select a non-default callback. Apple app/catalog and an empty internal group have been created separately; billing must select that catalog before IAP validation. CI signing/export, the first upload and Apple processing, real provider sign-in, and real sandbox purchase/restore remain unexecuted.

No merge, TestFlight upload, tester invitation, or application release is part of this PR preparation.

[github-actions]

Maple development preview: https://2259a105.maple-ca8.pages.dev

Commit: 7c0dd36b1a922d4b16ef84fc535355ba63ce16bd

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.