#11524 Prevent staging origins in production iOS builds

Summary

• force production API, Iroh broker, auth, and presence origins in iOS Release/TestFlight archives
• reject staging overrides in production-auth reloads and ignore staging broker bakes at runtime
• add archive and exported IPA artifact gates so production bundles cannot ship staging content

Verification

• bash -n ios/scripts/upload-testflight.sh ios/scripts/cloud-testflight.sh ios/scripts/reload.sh scripts/reload.sh scripts/lib/verify-ios-release-origins.sh
• swiftc -parse ios/cmuxPackage/Sources/cmuxFeature/MobileIrohRuntimeComposition.swift Sources/Auth/AuthEnvironment.swift
• bun test scripts/lib/mobile-attach.test.mjs --test-name-pattern 'iOS production-auth'
• bun test scripts/lib/iroh-production-gate.test.mjs --test-name-pattern 'iOS release artifact gate'
• cloud macOS reload attempted; remote build hit unrelated pre-existing BrowserAppLinkOpenRequest compile errors in Sources/Panels/BrowserPopupWindowController.swift

---

Summary by cubic

Moves iOS list-auth admission onto the irx control plane and hardens production distribution. Phones now admit Macs from the persisted account device directory rather than a grant alone, while production builds fail closed instead of inheriting staging settings.

Control Plane and Runtime

• Adds generated v1 control-plane types, socket delivery for relay and directory updates, and revocation handling that closes admitted sessions.
• Shows warnings for Macs that have not verified list-auth or need a version update.
• Keeps auth observation active across provisioning so implicit sign-out and account changes tear down the full irx runtime.
• Fences late network completions, scopes broker caches per bundle and broker, and protects Release credentials with the Keychain.
• Fixes stale-connection bootstrap retries, pairing timeout suppression, QR peer intent, and shared staging routes for debug Macs.

Production Safeguards

• Pins Release/TestFlight Stack credentials, API, Iroh broker, presence, and web origins to production at runtime and in Release.xcconfig.
• Makes --prod-auth reject staging or loopback API, broker, and presence overrides.
• Verifies archived apps and exported IPAs from their built Info.plist before export or upload, rejecting staging origins and development tags.
• Keeps Settings Networking aligned with the active irx runtime and makes unsupported mutations fail loudly.

Summary by CodeRabbit

• New Features

  • Added safer sign-out handling that stops active connections and prevents stale network responses from affecting a signed-out session.
  • Added production safeguards for authentication, API, broker, and presence service connections.
  • Added release checks that block uploads when non-production service settings are detected.
  • Added English and Japanese messages for computer authentication and outdated versions.

• Bug Fixes

  • Prevented development or staging overrides from redirecting production and release builds.
  • Improved session reconfiguration when authentication identity changes.