[AdamEssenmacher]

Summary

The published Sign-In 10.1.0 binding requires dynamic AppCheckCore and GTMSessionFetcher frameworks. Firebase 13.1.1 supplies those libraries statically, so a dependency range change would resolve NuGet restore but leave an invalid native loader dependency.

This companion to #256 builds the private Sign-In 10.1.0, AppAuth 3.0.0 and GTMAppAuth 6.0.0 closure statically on the producer Mac. Sign-In 10.1.0.1 keeps the managed API and uses the exact Firebase 13 shared packages. Consumers receive the private frameworks and resources in the Sign-In NuGet.

The existing Sign-In release channel stages the five-package closure and seals standalone and combined Firebase 13 evidence on the candidate. Firebase product packages are test fixtures only. Future release validation requires the matching published Firebase 13 release and its verified fixture payloads. The protected deployment job requires the four shared packages on both feeds and can push only the Sign-In root. Eligibility is disabled in this draft.

Validation

• Local prototype passed direct and transitive combined builds, offline rebuilds, and the simulator runtime probe for Firebase 13.1.1 with Sign-In.
• Published Sign-In 10.1.0 to 10.1.0.1 managed API compatibility passed for iOS and Mac Catalyst.
• Local staging exercised the static package inspector against the five-package closure. Release-tool regressions cover predecessor ordering, exact validation evidence, missing support on one feed, and PR publication eligibility. Legacy producer tests passed.
• The workflow will rerun both platform matrices against the staged candidate. Credentialed Sign-In, refresh, and Firebase Auth exchange remain separate device validation.