1.2.2: fix crash bugs and update circuit infra

[kidneyweakx]

v1.2.2 covers three connected areas: biometric auth hardening, MoproProofService crash resilience, and OpenPassport circuit infrastructure groundwork.

Biometric auth — BiometricGatekeeper and KeychainService now prefer .biometricsOnly policy with graceful passcode fallback for devices where Face ID is not enrolled. Face ID usage description added to Info.plist to satisfy App Store review.

MoproProofService stabilization — crash sentinel now uses snapshot-at-launch semantics so a past crash can't permanently disable proof generation across app versions. Auto-reset triggers when the build identifier changes, preventing stale sentinel state from blocking users after an update. Logging and error handling improved throughout the proof pipeline.

OpenPassport circuit infra — circuit file renamed from .json → .acir (correct Aztec format). CI pre-build script no longer overwrites a bundled .acir file, preventing silent regressions in CI. Resource lookup now falls back .acir → .json so existing installs aren't broken during the transition. Schema bumped to v4 to fix a CoreData materialization crash caused by Array<String> properties in IdentityEntities.

🎯 Impact

• User-facing: Face ID prompt appears correctly during identity key operations; no visible regression expected for existing users
• Migration: IdentityDataStore schema v4 — additive only (Array<String> columns replaced by Data?). Lightweight migration; no data loss expected. Test on upgrade from 1.2.1 before ship.
• Review focus:
  • IdentityEntities.swift — Array<String> → Data? encoding/decoding round-trip correctness
  • MoproProofService.swift — crash sentinel snapshot logic; confirm lastCrashSentinelBuildId reset path is correct on first launch after update
  • ci_pre_xcodebuild.sh — CI no longer generates a stub .acir; confirm CI passes without it

Changes

1) Biometric auth hardening

• BiometricGatekeeper.swift — auth policy changed to .deviceOwnerAuthenticationWithBiometrics; falls back to .deviceOwnerAuthentication when biometrics are unavailable
• KeychainService.swift — key creation and access control updated to match; KeychainService+Generation.swift aligned
• solidarity/Info.plist — NSFaceIDUsageDescription added

Main files:

• solidarity/Services/Identity/BiometricGatekeeper.swift
• solidarity/Services/Identity/KeychainService.swift
• solidarity/Info.plist

2) MoproProofService crash sentinel

Three layered improvements:

1. Snapshot-at-launch (a1d5806) — sentinel state is read once at app launch into an immutable snapshot; runtime proof calls can't be poisoned by a stale in-flight write
2. Auto-reset on build change (e8e44a4) — sentinel is cleared when CFBundleVersion changes, so a crash in build N doesn't block proof generation in build N+1
3. Logging & error propagation (74338d5) — structured log output at each fallback step (Mopro → Semaphore → SD-JWT); thrown errors carry context

Main files:

• solidarity/Services/ZK/MoproProofService.swift
• solidarity/Services/ZK/MoproProofService+Fallbacks.swift

3) OpenPassport circuit infrastructure

• Circuit file renamed openpassport_disclosure.json → openpassport_disclosure.acir (correct Noir/Aztec artifact format)
• ci_pre_xcodebuild.sh — stub generation removed; CI will use the bundled .acir file directly and fail fast if it's missing rather than silently falling back to a stub
• MoproProofService.swift — resource lookup tries .acir first, falls back to .json for backward compatibility
• PassportPipelineService.swift — updated resource reference
• solidarity.xcscheme + xcschememanagement.plist — scheme committed to repo so Xcode Cloud picks it up consistently

Main files:

• ci_scripts/ci_pre_xcodebuild.sh
• solidarity/Services/ZK/MoproProofService.swift
• solidarity/Services/Identity/PassportPipelineService.swift

4) CoreData schema v4

IdentityEntities had [String] properties that triggered a CoreData materialization crash on some devices. Replaced with Data? (JSON-encoded internally). IdentityDataStore migration marker bumped to v4.

Main files:

• solidarity/Models/IdentityEntities.swift
• solidarity/Services/Cache/IdentityDataStore.swift

📝 Notes

• MoproProofService fallback chain (Mopro → Semaphore → SD-JWT) is unchanged from 1.2.1; only the crash guard logic around it changed.
• The .acir → .json fallback in resource lookup exists only as a safety net during the transition period; it can be removed in 1.2.3 once all CI environments are confirmed to carry .acir.
• NSFaceIDUsageDescription is required by App Store even if the app uses LocalAuthentication; omitting it causes a binary rejection at upload time.
• No Package.resolved changes in this PR.