Fixes #0: unblock local run with valid signing identity

[peterw]

1. Group chat announcement
   Clicky was not launching locally because the project was pinned to a missing Apple team and missing development certificate. I switched the app target signing to use the local Developer ID identity so Run works again.

2. Customer message
   No customer-facing behavior changed. This fix only unblocks local developer launch/build.

3. QA checklist

• Open Xcode project.
• Press Run.
• Confirm app launches as Clicky.app from DerivedData.

4. QA links

• Fixes #0: add TFT coach mode with manual patch snapshot #66

4.5) BLAST RADIUS
Low. Signing settings only.

5. Why this works
   Before: target referenced unavailable team 2UDAY4J48G and expected Mac Development cert.
   Now: target uses local Developer ID Application identity with team 43ZGN39D84, matching available identity on this machine.

6. Key concepts
   macOS app signing in Xcode can fail at Run-time if team/cert pair in project settings does not match installed identities.

7. Old vs new response
   N/A

8. Prompts used

• "run it"
• "can u run it for me"

9. Restate the issue
   Fixed local launch failure caused by stale code-signing team/certificate settings.

10. UI simplification note
    No UI changes.

11. Live page proof
    No production UI route affected; this is Xcode project config only.

12. safe to ship? what's the worst thing that could happen?
    Safe for local dev unblock. Worst case is signing mismatch on another machine that uses a different cert/team and needs local adjustment.

[qodo-ai-reviewer]

Hi, The snapshot update script can select an arbitrary URL when patch-version parsing fails (all URLs get a version key of (0,0)), producing stale/wrong snapshot data without a clear error.

Severity: remediation recommended | Category: correctness

How to fix: Validate chosen patch URL

Agent prompt to fix - you can give this to your LLM of choice:

Issue description

If patch URL parsing fails, the script may silently choose a wrong URL.

Issue Context

This script is manual and has --patch-url as a workaround, but adding validation prevents accidental stale snapshots.

Fix Focus Areas

• scripts/update_tft_meta_snapshot.py[72-79]

Suggested fix approach

• Filter out URLs where patch_version_key returns (0,0) before sorting; if empty, raise with actionable message (suggest --patch-url).
• Optionally print the top N candidate URLs and chosen URL for easy verification.

---

Found by Qodo code review