apple signing: every signable target (extensions, App Group check), build keychain unlock over SSH, api confirm docs

skills/build-and-sign/SKILL.md

@@ -19,7 +19,7 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
 1. **Read.** `storebound apple signing status`: is the bundle id registered (else `storebound apple bundle`), which
    capabilities it has vs `apple.signing.capabilities`, the distribution certificates of the team and whether this
    Mac holds a private key for one (a key file in `.storebound/signing/` or an identity in the keychain), App Store
-   profiles per bundle id (app + `apple.signing.extraBundleIds` for extensions) and whether Xcode has them installed.
+   profiles per bundle id (the app and every extension / widget / watch app / App Clip found in the Xcode project, or `apple.signing.extensions`; `extraBundleIds` adds more) and whether Xcode has them installed. `signing ensure` registers the extensions' bundle ids, enables the capabilities their entitlements need and (manual style) makes their profiles; an App Group the profile lacks is reported with the developer portal link and steps (the API cannot assign a group; then `signing ensure --refresh-profile`, store-pitfalls 120).
    It also compares three places a capability must be and names what is missing where: the App ID, the config's
    `apple.signing.capabilities` and the iOS project's `.entitlements` (`aps-environment` = PUSH_NOTIFICATIONS,
    `com.apple.developer.game-center` = GAME_CENTER, associated domains, Sign in with Apple, iCloud, app groups, ...;
@@ -57,7 +57,12 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
    number**: later steps use exactly it. Any archive or export failure exits non-zero, so `apple build && apple upload`
    stops there; an export failure shows the IDEDistribution log's real error lines. xcodebuild runs with Apple's tool
    folders first on PATH (a Homebrew rsync breaks Xcode's IPA step: "exportArchive Copy failed"; `storebound doctor`
-   flags it).
+   flags it). Over SSH or in CI (no GUI session) codesign fails with errSecInternalComponent on a locked keychain:
+   `apple build` stops first and names the fixes. `STOREBOUND_KEYCHAIN_PASSWORD=... storebound apple build
+   --keychain-unlock` unlocks the login keychain and sets its key partition list (the password is read from the
+   environment and never printed); `--keychain <path>` signs with a build keychain (`--keychain <path> --keychain-unlock`
+   unlocks that one; `signing ensure --keychain <path>` imports the key + certificate into it). With manual signing it
+   also stops when a target's App Group is missing from its installed profile (store-pitfalls 120).
    - Capacitor: the archive ships the web assets `npx cap sync` copied last. Set `build.prebuild` (e.g.
      `"npm run build && npx cap sync"`; per store `apple.prebuild` / `play.prebuild`) and `apple build` / `play build`
      run it first (once per `flow run`; `--no-prebuild` skips it). Then the copied `public/index.html` must be newer