Pin XcodeGen for reproducible CI

[ColumbusLabs]

Why

PR #98 passed iOS generation with XcodeGen 2.45.4. Minutes later, post-merge main CI run 30503532136 installed newly released XcodeGen 2.46.0 and failed because that version emits a different PBXProject target order. A follow-up PR runner then installed 2.45.4 from a different Homebrew snapshot, proving unpinned Homebrew resolution is not reproducible across the runner fleet.

Change

• Download the official XcodeGen 2.45.4 release archive directly in the iOS CI job.
• Verify SHA-256 090ec29491aad50aec10631bf6e62253fed733c50f3aab0f5ffc86bc170bdbef before use.
• Add only the scoped extracted binary to GITHUB_PATH.
• Keep the tracked generated project at its verified XcodeGen 2.45.4 output.

No app source, target settings, product versions, or build numbers change.

Validation

• Official release asset and checksum verified locally.
• The pinned 2.45.4 archive generated a byte-clean tracked Xcode project locally.
• git diff --check passed.
• PARSER_LINT_BASE=origin/main ./Scripts/lint.sh lint passed, including CI path gate tests.
• PR CI will exercise the checksum-pinned install and generated-project cleanliness check.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.