fix(ios): pick upstream Xcode 27 archive fixes (NSE linker flags, pod deployment floor, C secp256k1) - #199

)

Xcode 27 rejects generated CocoaPods targets with deployment versions
below iOS 15, even though the app already requires iOS 16. Raise lower
explicit pod deployment targets to the existing iOS 16 minimum during
installation, preserving targets that require a newer version.

On main at 7852b16, the ordinary unsigned Release build with exact
Xcode 27.0 failed on pod targets set to iOS 9–13. After this change and
a normal pod install, none of the 189 generated build configurations
specifies a target below iOS 16, and the same build passes
deployment-target validation without a command-line override.

The full build remains blocked by the independent swift-secp256k1 0.21.1
`UInt256.words` compiler ambiguity. This PR does not fix or change that
dependency. Xcode pin
[buzz-releases#110](squareup/buzz-releases#110)
remains gated on a complete ordinary release build and its other
prerequisites.

Related: Wes’s [PR block#8330](block#8330)
independently includes a similar Podfile fix alongside DeviceHub
changes. This PR contains only the Podfile floor and its lockfile
checksum. Full local `just ci` passed; focused iOS validation above is
complete. The regenerated lockfile changes only the Podfile checksum;
`pod install --deployment` succeeds with CocoaPods 1.16.2.

---------

Signed-off-by: Tom Brow <[email protected]>
(cherry picked from commit 46159fc)
Signed-off-by: Ross Hartmann <[email protected]>

Replace the Swift secp256k1 wrapper with a small native adapter over
Bitcoin Core libsecp256k1. This is an alternative to the wrapper upgrade
in [block#8381](block#8381), not an additional
change to merge alongside it.

The adapter covers the three Nostr operations Buzz needs: x-only
public-key derivation, BIP-340 signing, and signature verification. It
compiles pinned, unmodified upstream C source through SwiftPM. There is
no build plugin, plugin approval script, or underscored Swift import.
The app and notification extension use an explicit C module map and
header search path.

This trades the third-party Swift wrapper for a Buzz-owned adapter and
responsibility for updating the vendored C source. Upstream v0.8.0
source, its license, and update provenance are included. The release
Xcode pin remains separate in
[buzz-releases#110](squareup/buzz-releases#110).

- Native package tests passed on Xcode 27.0 and 26.5: 96 XCTest tests
and 65 Swift Testing tests per toolchain.
- Added tests cover the official BIP-340 vectors for 32-byte Nostr
messages, invalid secret keys, and malformed input lengths.
- Full unsigned Release app and notification extension build passed on
exact Xcode 27.0.
- Vendored files were compared byte-for-byte with upstream v0.8.0.
- Full local `just ci` passed.
- [Hosted full unsigned iOS Release
build](https://github.com/block/buzz/actions/runs/38924020583/job/117051237094)
passed. [Hosted Native Swift
validation](https://github.com/block/buzz/actions/runs/38924020583/job/117051237153)
passed, including the complete simulator build and native controls/push
navigation tests.
- Codex code review and security review completed with no findings.

- [x] Tom selected the direct-C approach with vendored upstream source;
[the wrapper alternative](block#8381) is
closed.

Signed-off-by: Tom Brow <[email protected]>
(cherry picked from commit 7396243)
Signed-off-by: Ross Hartmann <[email protected]>

Inventory delta (drop/upstream-present) for the picked b270437, 46159fc
and 7396243 paths, and an amendment for five newly modified upstream files
(262 -> 267).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Ross Hartmann <[email protected]>

Fork runners refuse jobs whose workflow differs from main
(public_workflow_not_current), so the b270437 CI lane change is not taken.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Signed-off-by: Ross Hartmann <[email protected]>