build-time-secret-injectionlisted

# Build-time Secret Injection (Apple-platform) **Tuist assumption**: the `Project.swift` snippets below assume the app's `.xcodeproj` is generated by Tuist from a root-level `Project.swift` (Tuist's own convention keeps `Tuist/` for `Package.swift` and shared helpers, not for `Project.swift` itself). A hand-maintained `.xcodeproj` needs no `Project.swift` step — see **Non-Tuist projects** below for the equivalent (an xcconfig referenced directly from the target's Build Settings → Configurations, instead of via `Project.swift`). ## When to invoke Any task that introduces or wires values which are: - Technically **app-public** once the app ships (embedded in `Info.plist`, visible in shipped binary, observable in network traffic), AND - **Pre-launch sensitive** (committed to public repo before ship = ad-fraud reconnaissance window, convention violation among collaborators, or fingerprinting of unreleased product) Examples: - AdMob App ID + Banner / Interstitial / Rewarded Unit IDs - ASC API `.p8` key, key-id, issuer ID, ASC numeric app-id - Any third-party SDK app key (Firebase, RevenueCat, etc.) where the convention is "hold until ship" Do NOT invoke for: - True per-deploy secrets (signing certs, CloudKit production API keys, push notification keys) — those have stricter patterns (see `apple-public-repo-security`) - Values genuinely public from day 1 (bundle IDs, CKContainer IDs, IAP product IDs, marketing URLs) ## The pattern ### Two storage layers, one mechanism per la