Ignore com.apple.developer.healthkit.access entitlement

[Badlazzor]

Summary

• Adds com.apple.developer.healthkit.access to ServiceTypeByKey as Ignored, alongside other metadata-only companion keys (icloud-container-identifiers, ubiquity-container-identifiers).
• Adds a regression test covering Entitlement.Capability() returning (nil, nil) for the new key.

Why

Apple introduced com.apple.developer.healthkit.access with iOS 17.5 / Xcode 15.3 (May 2024). It declares which HealthKit data categories an app accesses and is a companion to the base com.apple.developer.healthkit key — it does not require a separate capability registration in App Store Connect.

Because the allow-list does not include it, Entitlement.Capability() returns unknown entitlement key: com.apple.developer.healthkit.access. That error propagates through SyncBundleID → ensureBundleID and breaks xcode-archive@6.x (both 6.0.0 and 6.0.1) with:

failed to manage code signing: failed to ensure code signing assets:
failed to ensure profiles: failed to ensure application identifier for <bundle>:
failed to update bundle ID capabilities:
unknown entitlement key: com.apple.developer.healthkit.access

The same project builds successfully on xcode-archive@5.7.0. The strict check is not new to 6.x (relevant files are byte-identical from alpha.58 through alpha.81); 5.7.0 simply does not reach SyncBundleID for the affected bundle ID on those projects, while 6.x does. Fixing the allow-list unblocks 6.x adoption regardless of which upstream change changed the reachability.

Impact

Unblocks xcode-archive@6.x for any target using HealthKit on iOS 17.5+ with automatic_code_signing: api-key. Needed for the Bitrise React Native Build Cache private beta, which recommends upgrading xcode-archive to 6.x.

Follow-ups (not in this PR)

• Audit ServiceTypeByKey against Apple's current entitlements reference (weatherkit, kernel.extended-virtual-addressing, kernel.increased-memory-limit, authentication-services.credential-provider-ui, matter.allow-setup-payload etc.) — each will trip the same hard error the moment it crosses SyncBundleID.
• Consider making Capability() warn-and-skip on unknown keys instead of hard-erroring, analogous to ProfileAttachedEntitlement, so the step is resilient to future Apple additions until the allow-list catches up.

Test plan

• go test ./autocodesign/... (including new TestCapability_HealthKitAccessIgnored)
• go vet ./autocodesign/...
• Integration: build an iOS 17.5+ target with com.apple.developer.healthkit.access in its entitlements via xcode-archive@6.x after dep bump; confirm no unknown entitlement key error

🤖 Generated with Claude Code