fix(mobile): give the fork's share extension and keychain their own identities

[jimprince]

Problem

The fork app and widgets already used Brad's identities, but its share extension and keychain still used upstream identifiers derived before the fork overlay. That left production signing dependent on upstream identities and app groups.

Fix

Derive the share extension, shared app group and keychain identity from the fork app bundle ID in fork-config.ts. Production uses com.brad.t3code, com.brad.t3code.widgets and com.brad.t3code.sharing with group.com.brad.t3code. Development and preview retain their distinct suffixes. Preserve upstream configuration and plugin options.

This PR is based on product/native-hygiene-20261012 (PR #88), so the diff contains only the droppable fork-mobile-identities concern; all 157 lower patch objects are unchanged. The deployment guide lists the three Apple identifiers and required profiles.

Checks

Exact-tip candidate CI: https://github.com/jimprince/t3code/actions/runs/38166063153 (3883c14).

Six behavioral config tests pass for each of production, development and preview; the new assertions were seen red against the original overlay. Mobile typecheck and vp check pass (zero errors; existing warnings). Offline Expo introspection passes for all three variants. Development AND production iOS prebuilds pass on Linux without installing dependencies; generated Debug/Release bundle IDs, entitlements, app groups and URL schemes match the fork configuration. Isolated StGit replay, documentation and release-note checks pass.

Not included

Apple/EAS account or credential operations, workflow dispatches, a signed IPA, native compilation, TestFlight upload/install, or OTA delivery. Credential validity, membership/agreement status, domain/Clerk authorization and next remote build number remain unknown. The unsigned Expo push entitlement is development; distribution signing must produce production entitlements. Existing associated domains and the extra development-client URL scheme remain unchanged.

Built by GPT-6.1 Sol agent via T3 Code

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	20.9 KiB	—	29.3 KiB	✅
Codex	Live turn messages	—	2	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.2 KiB	—	29.3 KiB	✅
Claude	Live turn messages	—	2	—	8	✅

Baseline: unavailable · PR result: a82f686 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.