Baked directly into the project instead of overriding at build time -
no tool can programmatically edit this project's .pbxproj (xcodeproj
gem can't parse its format), and a command-line xcargs override applies
to the whole build graph, breaking the SPM package's own targets which
must stay on Automatic. Debug config left untouched so local Xcode
development still uses automatic signing.