Add iOS Swift Package publishing channel (optimization.swift)

[Alex Freas (akfreas)]

What

Adds a publishing channel that ships the native Swift Package to a separate distribution repo, contentful/optimization.swift, so consumers can add the SDK by URL (from: "x.y.z") like any other SwiftPM package — no monorepo clone, no pnpm install, no subdirectory tricks.

Implements IOS_SPM_PUBLISHING_PLAN.md (steps 2–5). The distribution repo is treated like an npm dist/: CI builds the package and pushes the built result; nobody commits to it by hand.

Changes

• Stop committing the JS bridge UMD. The iOS + Android UMD bundles are now gitignored and untracked; they are generated by @contentful/optimization-js-bridge, not hand-committed. This makes a stale bridge structurally impossible — it's rebuilt on every release/build.
• Build scripts. pnpm run ios:bridge / ios:build / ios:test build the bridge before swift build/swift test.
• Consumer-facing README.md + LICENSE in packages/ios/ContentfulOptimization/ (these ship to the distribution repo; links are absolute and it carries a "generated; do not file PRs here" note).
• publish-spm.yaml — on each v* release (or workflow_dispatch), builds the bridge (stamping the version into the UMD), assembles the package payload, and pushes a commit + tag to optimization.swift over SSH using the SPM_MIRROR_DEPLOY_KEY Actions secret (a writable deploy key provisioned by scripts/setup-spm-mirror-credential.sh).
• CI guard — a swift-package-build job (macOS) builds the bridge then runs swift build + swift test on PRs touching the package or the bridge. The existing e2e-ios-sdk-build job now also builds the bridge first (required since the UMD is no longer committed — SwiftPM silently ships an empty resource bundle for a missing .copy file, which would break the app at runtime).
• Test fix — corrected a stale ViewTrackingController resume-visibility assertion that didn't match the documented re-evaluate-on-resume behavior.
• Docs — recorded the release flow in packages/ios/README.md and the package AGENTS.md.

Validation

• Full main-pipeline green on this branch, including Swift Package Build & Test, Build iOS UI Test Bundles, and both E2E iOS UI schemes.
• Locally: the assembled publish payload (sources + freshly-built UMD + polyfills + README + LICENSE, no committed UMD) builds from a clean dir; swift test passes 93/93.
• The demo (optimization-ios-demo) builds against the local SDK with the bridge regenerated by its pre-build step.

Follow-ups (not in this PR)

• The deploy key + SPM_MIRROR_DEPLOY_KEY secret are already provisioned. After merge, the first dry run is a workflow_dispatch of publish-spm.yaml with a throwaway tag (e.g. v0.0.1-alpha.1) — workflow_dispatch only becomes available once this workflow is on main.
• optimization.swift is currently INTERNAL, so from: URL resolution will need auth (or the repo made public) before the demo can point at the URL instead of the local path.

[wiz-inc-38d59fb8d7]

Wiz Scan Summary

Scanner	Findings
Vulnerabilities	-
Sensitive Data	-
Secrets	-
IaC Misconfigurations	1
SAST Findings	-
Software Management Findings	-
Total	1

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.