apple build: --derived-data (default <out>/DerivedData with --out), --path-free (Swift/clang prefix maps, no serialized debug options) and an archive path scan

skills/build-and-sign/SKILL.md

@@ -64,6 +64,11 @@ when the owner said so for this run). The MCP server offers only `apple_signing_
    unlocks that one; `signing ensure --keychain <path>` imports the key + certificate into it). It
    also stops before the archive when a target's App Group is missing (manual: its installed profile; automatic: the profile
    the API lists; store-pitfalls 121; `--allow-app-group-gap` overrides).
+   `--out <dir>` also puts DerivedData in `<out>/DerivedData` (`--derived-data <dir>` / `apple.build.derivedData`
+   overrides), so a build is hermetic per output folder. Building under a shared folder, or anything a privacy gate scans:
+   add `--path-free` (`apple.build.pathFree`): Swift and clang prefix maps keep the home folder, user name and checkout
+   out of the binary and the archive's dSYMs / Symbols, and the build stops before the export on a leftover hit
+   (store-pitfalls 124). `--scan-paths` scans without remapping.
    - Capacitor: the archive ships the web assets `npx cap sync` copied last. Set `build.prebuild` (e.g.
      `"npm run build && npx cap sync"`; per store `apple.prebuild` / `play.prebuild`) and `apple build` / `play build`
      run it first (once per `flow run`; `--no-prebuild` skips it). Then the copied `public/index.html` must be newer