Fix CodeQL Swift build on macos-26 runners

[cwbooth5]

Stack (merge top-down: #25 into video first, then #24 into main)

1. Release 1.4.0: encrypted video, alphanumeric PINs #24 video → main: Release 1.4.0
2. Fix CodeQL Swift build on macos-26 runners #25 fix/codeql-xcode-26 → video: CodeQL Swift build fix

Summary

The CodeQL Advanced workflow has failed on every Swift run since 2025-09-10 (and is currently disabled manually). This PR fixes the Swift job:

• Xcode pin: Xcode_16.2.app → Xcode_26.5.app. macos-latest now resolves to the macos-26 image, which only ships Xcode 26.x. This matches build-and-test.yml/publish-release.yml on video and the local toolchain.
• Macro validation: adds defaults write com.apple.dt.Xcode IDESkipMacroFingerprintValidation -bool YES and -skipMacroValidation, needed for Mockable's Swift macros (same as the other workflows).
• Build destination: replaces -sdk iphonesimulator18.4 -destination 'platform=iOS Simulator,name=iPhone 16,OS=18.4' with -destination 'generic/platform=iOS Simulator'. The 2025-09 failures came from this hardcoded SDK/runtime: run logs have expired, but the annotations show xcodebuild exit 64 (unknown SDK) and, once -sdk was dropped, exit 70 (destination not found). A generic destination doesn't depend on which simulator runtimes the image ships.
• SHA pins: actions/checkout and github/codeql-action/{init,analyze} are pinned to the same commit SHAs as on video, since this PR now targets video (Release 1.4.0: encrypted video, alphanumeric PINs #24).

Caveats

• Targets video, not main. main's code doesn't compile under Xcode 26.5 / Swift 6.3 (sending 'device' risks causing data races in CameraFocusService.swift), and main's build-and-test.yml still uses Xcode 26.0.1, whose iOS 26.0 platform is no longer on the runner image. video fixes both, so this lands on main together with Release 1.4.0: encrypted video, alphanumeric PINs #24.
• The workflow is disabled_manually, so it won't run on this PR. Re-enable it with gh workflow enable codeql.yml (or from the Actions tab).
• github/codeql-action v3 is deprecated in favor of v4. That bump is left for a follow-up.

Test plan

• Ran the exact CI build command locally with Xcode 26.5 against the video branch: BUILD SUCCEEDED
• Same command against main: fails only on the Swift 6.3 concurrency errors above (why this targets video)
• Verified the pinned action SHAs exist upstream and the YAML parses
• Re-enable the workflow and confirm the Swift analysis passes once Release 1.4.0: encrypted video, alphanumeric PINs #24 merges to main

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

iOS Test Results

0 tests  ±0   0 ✅ ±0   0s ⏱️ ±0s
0 suites ±0   0 💤 ±0 
0 files   ±0   0 ❌ ±0 

Results for commit 5fd88a0. ± Comparison against base commit e799666.