fix(mobile): Pylon Connect reaches mobile builds

[rynfar]

Pylon Connect is fully implemented on mobile — CloudAuthProvider, linkEnvironment, the onboarding sheet, and a "Pylon Connect" section in Connections — but no mobile build has ever received the public config it needs, so every one of those surfaces was omitted at runtime.

The problem

relay_public_config in release.yml reads the Clerk publishable key, JWT template, and relay domain from the GitHub production environment and feeds them to the desktop, CLI, and hosted-web jobs. The two mobile EAS workflows are not part of that workflow. They get their config from eas env:pull, which reads an expo.dev environment store that nothing ever populated — all three EAS environments were empty.

The failure is invisible. hasCloudPublicConfig() gates every Connect surface, and each one returns null when config is absent: SettingsRouteScreen falls back to the local settings screen, SettingsAuthRouteScreen renders nothing, CloudEnvironmentRows drops to connected-only. No error, no empty state — the app reads as though it never shipped the feature.

The fix

The GitHub production environment stays the single source of truth. mobile-eas-production.yml declares that environment and mirrors the values into the EAS production, preview, and development environments before building. The mirror is necessary rather than incidental: EAS build servers read their own store, and a repo-root .env is gitignored so it never reaches them.

Both mobile workflows then run scripts/verify-mobile-connect-config.ts, which resolves the public app manifest and fails the job when clerk.publishableKey, clerk.jwtTemplate, or relay.url is missing. Partial configuration is treated as none, matching relay_public_config.

.env.example now carries Pylon's own public identifiers. That was the recorded revisit condition for upstream E21, which was skipped because it pointed fresh clones at T3's infrastructure; Pylon owns its Clerk application and relay now.

Verification

• vp test run scripts/lib/public-config.test.ts apps/mobile/src/features/cloud/publicConfig.test.ts — 11 passed
• vp run -F @t3tools/scripts typecheck — clean
• Resolved the preview manifest locally: hasCloudPublicConfig => true
• Guard exercised both ways: exit 1 with config absent, exit 0 with it present
• Both workflow files parse; production environment has no protection rules, so declaring it adds no approval gate

No UI changed, so there are no before/after images — the same components render, now with the config they were always waiting for.

Note: both mobile workflows still skip entirely until an EXPO_TOKEN secret exists on the repository.

Model: Claude Opus 5. Harness: Claude Code.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

⚠️ The latest CI run did not produce a thread transfer result for 5f899cf.

This comment will update automatically after the next completed run.