Signed AAB guardrails, injected signing args, IPA version train check, Play notes lint at build

skills/store-pitfalls/SKILL.md

@@ -1283,3 +1283,32 @@ that fails without the fix (see CONTRIBUTING.md).
 - **Do:** read the "read ... ago" stamp and refresh; for Play keep your own history; compare with the console if in doubt.
 - **Guard:** `settleStoreReads` (`cli/lib/reviews.ts`) throws when every asked store failed (`tests/reviews.test.ts`);
   the Reviews tab states the Play 7-day window and that Apple's API can lag.
+
+## 107. `play build` in CI gave an unsigned AAB, Play said 403 "All uploaded bundles must be signed"
+
+- **What happens:** the project's `app/build.gradle` signs only from a local `keystore.properties` (absent in CI). The
+  upload key in `ANDROID_KEYSTORE` / `ANDROID_KEYSTORE_PASSWORD` / `ANDROID_KEY_ALIAS` / `ANDROID_KEY_PASSWORD` reached
+  Gradle only through `ORG_GRADLE_PROJECT_*`, which that build file does not use; the AAB came out unsigned and the
+  refusal came only at upload.
+- **Do:** set the four variables (env or `.storebound/credentials.json`); `play build` now also passes them as
+  `-Pandroid.injected.signing.store.file|store.password|key.alias|key.password`. The printed command and the plan show
+  the passwords as `***`.
+- **Guard:** `signingArgs` / `maskArgs` (`cli/lib/gradle.ts`); right after the build, and before `play upload` /
+  `play release` of a local AAB, `assertAabSigned` checks the META-INF `*.SF` + `*.RSA|DSA|EC` entries (and runs
+  `jarsigner -verify` when a JDK is on PATH) and fails with the fix, before any upload (`tests/build-sign.test.ts`).
+
+## 108. `apple build` exported MARKETING_VERSION 1.0, not the version being released
+
+- **What happens:** the Xcode project ignored the version the release script intended (an env var the project read), so
+  the IPA's `CFBundleShortVersionString` was 1.0 and the build went into the wrong version train.
+- **Do:** make the project read the intended version (`xcodebuild MARKETING_VERSION=x.y.z`, or set it in the project),
+  build again. `--allow-version-mismatch` goes on anyway.
+- **Guard:** `ipaVersionProblem` (`cli/lib/xcode.ts`): `apple build --version X` refuses an IPA with another version, and
+  `apple upload` compares the IPA with the editable App Store version before any upload (`tests/build-sign.test.ts`).
+
+## 109. Play release notes naming iOS / iPhone / App Store were refused only at release time
+
+- **What happens:** the Play Metadata policy rule (pitfall 77) stopped `play release` after the long build.
+- **Do:** write the notes without other platforms or stores; `[play]` / `[apple]` tags split shared notes.
+- **Guard:** `storebound check` reports the "What's new" of every Play language, `play build` refuses before Gradle runs
+  (`notesGuard`), `play upload` / `play release` refuse before any edit (`refusePlayNotes`).