fix(ios): app must LINK Wgnest (not embed-only) so the archive resolves it

The previous framework re-wiring set the app to embed Wgnest.xcframework
without linking it. Xcode's "Embed & Sign" links AND embeds; embed-only
leaves the xcframework's device slice unresolved for the app target, which
failed the Release archive (exit 65) after both targets compiled.

App now links + embeds + signs Wgnest; the extension still links only (no
nested Frameworks/ in the .appex, so ITMS-90205/90206 stays fixed).

Author: TheTrunk

clients/mobile/ios/CumulusVPN.xcodeproj/project.pbxproj

@@ -7,6 +7,7 @@
 	objects = {
 
 /* Begin PBXBuildFile section */
+		03CACF36D68E6C404FD31256 /* Wgnest.xcframework in Frameworks */ = {isa = PBXBuildFile; fileRef = 739B2C180B93FF5024705C79 /* Wgnest.xcframework */; };
 		08EABFA8AF011AE3C864F73D /* PrivacyInfo.xcprivacy in Resources */ = {isa = PBXBuildFile; fileRef = 13B07FB81A68108700A75B9A /* PrivacyInfo.xcprivacy */; };
 		0C80B921A6F3F58F76C31292 /* libPods-CumulusVPN.a in Frameworks */ = {isa = PBXBuildFile; fileRef = 5DCACB8F33CDC322A6C60F78 /* libPods-CumulusVPN.a */; };
 		0EB3C9EDAFF85C91336E62FA /* PacketTunnelExtension.appex in Embed App Extensions */ = {isa = PBXBuildFile; fileRef = 55BBA7C9647FD961C10653B4 /* PacketTunnelExtension.appex */; settings = {ATTRIBUTES = (RemoveHeadersOnCopy, ); }; };
@@ -90,6 +91,7 @@
 			files = (
 				0C80B921A6F3F58F76C31292 /* libPods-CumulusVPN.a in Frameworks */,
 				DD0160FCAB9793E9B91B94C4 /* NetworkExtension.framework in Frameworks */,
+				03CACF36D68E6C404FD31256 /* Wgnest.xcframework in Frameworks */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};

clients/mobile/ios/scripts/add-wgnest-framework.rb

@@ -49,7 +49,13 @@
   end
 end
 
-# --- App: EMBED + SIGN, so Wgnest ships in CumulusVPN.app/Frameworks. ---
+# --- App: LINK + EMBED + SIGN (Xcode's "Embed & Sign"). The app must LINK the
+#     xcframework, not merely list it in a copy phase — linking is what resolves
+#     the correct device slice for the app target so the embed can copy it.
+#     Embed-only left Wgnest unresolved for the app and broke the archive. ---
+unless app.frameworks_build_phase.files_references.include?(ref)
+  app.frameworks_build_phase.add_file_reference(ref)
+end
 embed = app.copy_files_build_phases.find do |p|
   p.symbol_dst_subfolder_spec == :frameworks && p.name == "Embed Frameworks"
 end