[AdamEssenmacher]

Firebase package production currently relies on CocoaPods and packed native payloads. This experiment moves the Firebase line and its existing shared native dependencies to Firebase 13.1.1, using Google's official prebuilt archive and stock Xamarin.Build.Download 0.11.6. NuGets contain managed bindings, delivery targets and notices; application builds acquire the native SDK through XBD.

• Preserve package IDs, managed names and target frameworks. Non-Firebase product source and Sign-In 10.1.0 remain unchanged, with no Sign-In binding revision.
• Verify the official archive digest, paths/links, ownership, slices, duplicate frameworks, resources and tools before packing. Resources and Crashlytics tools come from the shared cache.
• Enforce exact bounded dependency versions in all 23 NuGets. Validate agreement between Cake, project references and the ownership manifest; reject duplicate dependencies.
• Include Firestore 13 API additions and expression-typed stage constructors. Reuse the shared simulator selector. Limit audit normalization to opted-in prebuilt layouts, preserving CocoaPods module maps.
• Run read-only schema, audit and native/consumer validation for same-repository PRs, including future branches. Publishing is disabled.

Local checks for the review fixes: all 23 packages pack and pass bounded-dependency/native-free inspection; 11 native-delivery tests, 72 release-tool tests and 125 .NET audit tests pass. Functions/Storage API audits pass without new suppressions. The earlier head passed the complete GitHub native matrix; the refreshed full matrix is rerunning for the current head. See docs/FIREBASE_13_XBD_VALIDATION.md for detailed scope and limits.

Promotion blockers

• Implements Preserve non-Firebase producer baselines before Firebase 13 cutover #257 with an isolated locked legacy producer. Existing non-Firebase commands and Sign-In 10.1.0.0 are preserved; a new read-only CI lane validates its packed delivery and Firebase 12 integration baseline. Current-head CI is rerunning. Fixes Preserve non-Firebase producer baselines before Firebase 13 cutover #257 on maintainer merge.
• Existing Sign-In NuGet dependency bounds still require a separate compatibility decision; do not silently widen them or republish an existing version.
• Analytics/App Measurement licensing, acceptance wording and downstream notice obligations remain unresolved.
• Stock XBD 0.11.6 does not verify Sha256 after a fresh ZIP download. Producer verification independently enforces the official digest. Stronger consumer integrity remains a production-promotion question; no custom downloader was added.
• Promotion to the sealed, approval-gated release pipeline remains separate work.

This PR remains a draft experiment. No merge or publication is requested.

The legacy producer uses reviewed commit/tree inputs without resetting the checkout or copying untracked files. Existing product edits fail rather than silently using stale inputs. See docs/LEGACY_PRODUCTION.md. Local validation includes the original Sign-In command, its five published-input fingerprints and all standalone platform consumers. No Sign-In source, native version, dependency declaration or binding revision changed.

[AdamEssenmacher]

Code review: 9 findings. The most important is the mixed-build guard in build.cake, which breaks every Google.SignIn build, including the default ci.yml lane.