feat(you): show the commit SHA in the version footer

[bmc08gt]

The You screen footer's build number is Xcode Cloud's run counter (CFBundleVersion), so it maps to no commit without an App Store Connect lookup. The footer now shows the first 10 characters of the commit SHA on a second line, in every build, App Store and TestFlight included:

Version 2026.9.3 • Build 272
2acfecffeb • beta

This matches Android's footer from code-payments/code-android-app#1571. Line 2 ends with • development in a DEBUG build and • beta on TestFlight. An App Store build shows no track, so its line 2 is only the hash. A build with uncommitted changes shows 2acfecffeb*. With no commit, the footer falls back to the old single line.

How the SHA gets into the build

Scripts/write_commit_xcconfig writes GIT_COMMIT_SHA = <sha> to Configurations/commit.local.xcconfig, which is gitignored and optionally included by base.xcconfig. The Flipcash Info.plist exposes it as FCGitCommit, and AppMeta.commit reads it with the same unknown fallback as AppMeta.build.

The script runs from two places:

• Xcode Cloud: the new ci_scripts/ci_pre_xcodebuild.sh calls it before every xcodebuild. It takes CI_COMMIT and never appends *, since package resolution and the generated Google plist can touch the clone's working tree.
• Local builds: a second build pre-action on the Flipcash scheme, next to "Pull Secrets". It uses git rev-parse HEAD and appends * when git diff --quiet HEAD reports changes to tracked files, the same rule Android uses. Untracked files don't count. GoogleService-Info.plist is excluded because it's tracked but the "Generate Google" phase rewrites it from secrets on every build. On Xcode Cloud this pre-action also runs, but CI_COMMIT takes precedence there too.

I used a scheme pre-action rather than a Run Script phase for two reasons. Pre-actions run before build settings are resolved, so the value lands in the same build; a Run Script phase would always be one build behind. And under ENABLE_USER_SCRIPT_SANDBOXING, a Run Script phase can't read .git. A local build confirmed the built Info.plist had FCGitCommit set to the current SHA and CFBundleVersion still at 272.

The script never fails the build. If it can't find a 40-character SHA, it deletes any stale file and base.xcconfig falls back to unknown. A clone that never ran the script gets the same fallback.

CFBundleVersion is untouched, so SessionAuthenticator.requiresUpgrade and the server's minBuildNumber behave as before.

App changes

• BuildCommit (FlipcashCore) parses the stamp and produces the 10-character label with the * marker. AppMeta.versionFooter assembles the two lines. BuildCommitTests covers the cut, the marker, unusable stamps, and each footer shape.
• ReleaseTrack picks the track. TestFlight and the App Store run the same Release binary, so it reads StoreKit's AppTransaction environment: .sandbox means TestFlight. The You screen reads it once when it appears; if StoreKit can't answer, no track is shown. ReleaseTrackTests covers the mapping.
• The footer tap still drives only the 10-tap beta unlock.
• ErrorReporting.initialize() adds the raw stamp (including *) to Bugsnag's app metadata tab as commit.