apple build: --derived-data (default <out>/DerivedData with --out), --path-free (Swift/clang prefix maps, no serialized debug options) and an archive path scan

skills/store-pitfalls/SKILL.md

@@ -1533,3 +1533,17 @@ that fails without the fix (see CONTRIBUTING.md).
   update-or-first from the config instead of the store.
 - **Guard:** `cli/lib/release-kind.ts` (the kind from the store, the policy), `tests/update-gate.test.ts` (fake stores:
   update goes through, first release is exit 3, already there is exit 7), docs/bypass.md "Updates are agent steps".
+
+## 124. iOS builds leak the home folder: DerivedData in ~/Library and local paths in the binary and the symbols
+
+- **Symptom:** a release pipeline building under a shared folder outside the user's home (`apple build --out <dir>`)
+  still wrote DerivedData to `~/Library/Developer/Xcode/DerivedData`, and the app binary and the `.xcarchive`
+  `Symbols/*.symbols` / dSYMs held the home folder, the user name and the checkout path (a privacy gate counted 543 hits).
+- **Do:** `storebound apple build --out <dir> --path-free` (or `apple.build.pathFree: true`). With `--out` DerivedData is
+  `<out>/DerivedData` (`--derived-data <dir>` / `apple.build.derivedData` to choose); `--path-free` passes Swift
+  `-debug-prefix-map` + `-file-prefix-map` and clang `-ffile-prefix-map` for the home folder, checkout, out and DerivedData,
+  keeps dwarf-with-dsym (symbol upload still works) and scans the archive's Products, dSYMs and Symbols before the export.
+  A hit stops the build with the count and the first file + offsets. Xcode's own toolchain paths (`/Applications/Xcode.app`)
+  are not the user's and are not hits. A prebuilt vendored framework carries its own paths: rebuild it path-free.
+- **Never:** point a shared build folder at the default DerivedData, or run the privacy scan only after the upload.
+- **Guard:** `cli/lib/path-free.ts`, `tests/path-free.test.ts`, the hint when `--out` is outside the home folder.