docs: build-and-sign Mac App Store Tauri section, pitfall 114, changelog

skills/store-pitfalls/SKILL.md

@@ -1415,3 +1415,29 @@ that fails without the fix (see CONTRIBUTING.md).
   `storebound shots copy reviewed --lang de`. Captions over the limit (eyebrow 30, title line 28, sub 90, badge 18) are
   not kept.
 - **Guard:** `cli/shots/copy.ts`, `cli/lib/shots-copy-translate.ts`, `tests/shots-copy-translate.test.ts`.
+
+## 119. A Tauri Mac App Store build was refused (no sandbox, no profile, wrong installer certificate) or carried the builder's home folder
+
+- **What happens:** a plain `tauri build` makes a Developer ID app: no `com.apple.security.app-sandbox`, no
+  `embedded.provisionprofile`, signed with the wrong certificate, packed as a .dmg. Packed by hand into a .pkg it fails at
+  upload with ITMS-90xxx (sandbox, missing profile, CFBundleVersion not above the last one, no LSApplicationCategoryType) or
+  the .pkg is signed with an application certificate. Separately, rustc panic messages and debug info carry the
+  checkout, `~/.cargo` and the user name (`/Users/<name>/...`, hundreds of times in a release binary), which ends up
+  in a public download.
+- **Do:** `storebound apple build --platform macos --tauri <src-tauri> --path-free --dry`, then the same without `--dry`
+  in the Mac's logged-in GUI session (codesign over SSH fails with errSecInternalComponent). It needs, on the Mac: an
+  "Apple Distribution" (or "3rd Party Mac Developer Application") and a "Mac Installer Distribution" (or "3rd Party Mac
+  Developer Installer") identity in the login keychain, and an active MAC_APP_STORE profile
+  (`apple.signing.profileType: 'MAC_APP_STORE'`, `apple signing ensure`, or `--profile <file>`). The installer certificate
+  is a separate certificate type (`MAC_INSTALLER_DISTRIBUTION`). `--unsigned` checks the whole pipeline without them
+  (never uploadable). A universal build needs both Rust targets (rustup); with Homebrew Rust only the host
+  target exists: pass `--target aarch64-apple-darwin`.
+- **Guard:** `cli/lib/mas.ts` / `cli/apple/build-mas.ts`: entitlements generated with sandbox and application / team
+  identifier (the project's own keys kept), profile embedded through a tauri.conf overlay, bundleVersion from App Store
+  Connect (platform MAC_OS) so it increases, the built app checked (sandbox entitlement, no get-task-allow, category,
+  minimum OS, profile inside, version / build), `--path-free` remaps checkout / CARGO_HOME / RUSTUP_HOME / home in rustc,
+  drops debug info and symbols and fails when the home folder or user name is still in the app (without the flag the
+  same scan warns). `cargo trim-paths` is not used: it is nightly-only (cargo 1.98 refuses it). `apple upload <pkg>
+  --platform macos` refuses an unsigned .pkg or one not signed with an installer certificate before any network call
+  (`tests/mas-build.test.ts`). The `com.apple.pkg` file type of the API build upload is taken from Apple's schema and has not
+  been exercised against the live API yet; `--via altool` (`--type macos`) is the fallback.