com.apple.developer.devicecheck.appattest-environment was hardcoded to
"development" for every build, including the App Store/TestFlight
distribution build. Apple's App Attest servers validate this claim
against how the app was actually signed/distributed, so a "development"
claim on a real distribution build fails - guest session handshake
never gets past the challenge step, no store/city data ever loads.
Parameterized per configuration: development for Debug, production for
Release, via an APP_ATTEST_ENVIRONMENT build setting.
App Store Connect flagged a validation warning: code references a
location API (guest store locator) but Info.plist has no
NSLocationWhenInUseUsageDescription, which would cause an App Review
rejection if left unaddressed. Added via INFOPLIST_KEY_* build setting
since this target generates its Info.plist from build settings rather
than a static file.
Baked directly into the project instead of overriding at build time -
no tool can programmatically edit this project's .pbxproj (xcodeproj
gem can't parse its format), and a command-line xcargs override applies
to the whole build graph, breaking the SPM package's own targets which
must stay on Automatic. Debug config left untouched so local Xcode
development still uses automatic signing.
