ci(apple): add Xcode Cloud post-clone script

Xcode Cloud only checks out the repo, so ci_post_clone.sh installs swiftlint,
xcodegen and bun, downloads the prebuilt core (vnidrop.xcframework + Vnidrop.swift)
from the matching GitHub Release asset, and generates the project via localization,
version/app config codegen and xcodegen. Rust is never built on Xcode Cloud.

ci_scripts/README.md

@@ -0,0 +1,40 @@
+# Xcode Cloud CI scripts
+
+Xcode Cloud runs the scripts in this directory around each build. Only
+`ci_post_clone.sh` is used today; add `ci_pre_xcodebuild.sh` /
+`ci_post_xcodebuild.sh` here if later steps are needed.
+
+## What `ci_post_clone.sh` does
+
+The Xcode project (`apple/VniDrop.xcodeproj`) and its generated inputs are **not**
+committed — they are produced by XcodeGen, localization, and the Rust core build.
+Since Xcode Cloud only checks out the repository, the post-clone script:
+
+1. installs `swiftlint`, `xcodegen`, and `bun`;
+2. **downloads the prebuilt core** (`vnidrop.xcframework` + `Vnidrop.swift`) from
+   the matching GitHub Release asset `VnidropCore-<version>.zip` — Xcode Cloud
+   never builds Rust;
+3. runs localization + version/app config codegen and `xcodegen generate`
+   (equivalent to `make apple-project` without the `apple-core` step).
+
+The core asset for version `X.Y.Z` must be published on the `vX.Y.Z` release
+before an Xcode Cloud build for that version runs (see
+`apple/scripts/package-core.sh` and `.github/workflows/apple-release.yml`).
+
+### Overrides (env vars, optional)
+
+| Variable | Default | Purpose |
+|----------|---------|---------|
+| `VNIDROP_CORE_REPO` | `sudosylabs/vnidrop` | Release repository to download the core from |
+| `VNIDROP_CORE_TAG`  | `v<product-version>` | Release tag holding the core asset |
+
+## Workflow configuration (App Store Connect)
+
+The workflow itself (product, scheme, triggers, actions) is configured in App
+Store Connect, not in the repository. Point it at:
+
+- **Project:** `apple/VniDrop.xcodeproj` (generated by the post-clone script)
+- **Scheme:** `VniDrop` (App Store / TestFlight target; shared, see `apple/project.yml`)
+
+Archive actions use the release Rust profile via the published core asset; build
+and test actions reuse the same prebuilt core.

ci_scripts/ci_post_clone.sh

@@ -0,0 +1,72 @@
+#!/bin/bash
+#
+# Xcode Cloud post-clone step.
+#
+# The Apple Xcode project is generated (XcodeGen) and gitignored, and it links a
+# prebuilt Rust XCFramework plus generated localization/config files. Xcode Cloud
+# only checks out the repository, so this script:
+#   1. installs the non-Rust build tooling (swiftlint, xcodegen, bun);
+#   2. downloads the prebuilt core (vnidrop.xcframework + Vnidrop.swift) from the
+#      matching GitHub Release asset — we never build Rust here;
+#   3. reproduces `make apple-project` minus the Rust `apple-core` step.
+#
+# Xcode Cloud runs this from the `ci_scripts` directory; CI_PRIMARY_REPOSITORY_PATH
+# points at the checked-out repository root.
+set -euo pipefail
+
+REPO_ROOT="${CI_PRIMARY_REPOSITORY_PATH:-$(cd "$(dirname "$0")/.." && pwd)}"
+cd "$REPO_ROOT"
+
+echo "==> Installing build tooling (Homebrew)"
+# swiftlint: enforced by a build phase (fails the build if missing).
+# xcodegen: generates apple/VniDrop.xcodeproj from apple/project.yml.
+brew install swiftlint xcodegen
+
+echo "==> Installing Bun (localization generator)"
+if ! command -v bun >/dev/null 2>&1; then
+	curl -fsSL https://bun.sh/install | bash
+fi
+export BUN_INSTALL="${BUN_INSTALL:-$HOME/.bun}"
+export PATH="$BUN_INSTALL/bin:$PATH"
+
+# --- Prebuilt core: download instead of building Rust -------------------------
+# The Apple core (xcframework + UniFFI bindings) is published as a release asset
+# by apple/scripts/package-core.sh. See docs at the top of that script.
+VERSION="$(packaging/version/resolve-version.sh product)"
+CORE_REPO="${VNIDROP_CORE_REPO:-sudosylabs/vnidrop}"
+CORE_TAG="${VNIDROP_CORE_TAG:-v$VERSION}"
+CORE_ZIP="VnidropCore-$VERSION.zip"
+CORE_BASE_URL="https://github.com/$CORE_REPO/releases/download/$CORE_TAG"
+
+PKG_DIR="$REPO_ROOT/apple/VnidropCore"
+DOWNLOAD_DIR="$(mktemp -d)"
+trap 'rm -rf "$DOWNLOAD_DIR"' EXIT
+
+echo "==> Downloading prebuilt core $CORE_ZIP from $CORE_REPO@$CORE_TAG"
+curl -fsSL "$CORE_BASE_URL/$CORE_ZIP" -o "$DOWNLOAD_DIR/$CORE_ZIP"
+curl -fsSL "$CORE_BASE_URL/$CORE_ZIP.sha256" -o "$DOWNLOAD_DIR/$CORE_ZIP.sha256"
+
+echo "==> Verifying checksum"
+(
+	cd "$DOWNLOAD_DIR"
+	if command -v sha256sum >/dev/null 2>&1; then
+		sha256sum --check "$CORE_ZIP.sha256"
+	else
+		shasum -a 256 --check "$CORE_ZIP.sha256"
+	fi
+)
+
+echo "==> Installing core into apple/VnidropCore"
+unzip -q -o "$DOWNLOAD_DIR/$CORE_ZIP" -d "$DOWNLOAD_DIR/extracted"
+# Zip root holds: vnidrop.xcframework/ and Vnidrop.swift (see package-core.sh).
+rm -rf "$PKG_DIR/vnidrop.xcframework"
+cp -R "$DOWNLOAD_DIR/extracted/vnidrop.xcframework" "$PKG_DIR/vnidrop.xcframework"
+mkdir -p "$PKG_DIR/Sources/VnidropCore"
+cp "$DOWNLOAD_DIR/extracted/Vnidrop.swift" "$PKG_DIR/Sources/VnidropCore/Vnidrop.swift"
+
+# --- Generate the project (everything except the Rust core) -------------------
+echo "==> Generating localization, version/app config, and the Xcode project"
+make localization apple-version-config apple-app-config
+(cd "$REPO_ROOT/apple" && xcodegen generate)
+
+echo "==> ci_post_clone complete"