fix(mobile): prepare v1.0.7 OTA release

docs/mobile-ota.md

@@ -12,10 +12,10 @@ already installed build.
 
 ## Status
 
-The client is wired with the real server values (app id
-`9a66f3c2-fda7-416f-87e2-6db833b32e9d` and the Sauci code-signing certificate,
-SHA-256 fingerprint beginning `DF:C9:17:A9`). What remains is the native
-prebuild and a store build; see [Server registration](#server-registration).
+The client and checked-in native projects are wired with the real server values
+(app id `9a66f3c2-fda7-416f-87e2-6db833b32e9d` and the Sauci code-signing
+certificate, SHA-256 fingerprint beginning `DF:C9:17:A9`). A new store build is
+required before updates can flow; see [Server registration](#server-registration).
 
 ## How it works
 
@@ -54,7 +54,7 @@ runtimeVersion: { policy: 'appVersion' }
 ```
 
 The runtime version is therefore the `expo.version` field in `app.json`, for
-example `1.0.6`. An update is only offered to builds whose runtime version
+example `1.0.7`. An update is only offered to builds whose runtime version
 matches exactly.
 
 The practical rule: **any change that touches native code, native dependencies,
@@ -136,28 +136,27 @@ the Sauci app.
 
 `apps/mobile/ios` and `apps/mobile/android` are committed but generated by Expo
 CNG, and `docs/releasing.md` treats `expo prebuild` as a source change rather
-than a release step. The native projects currently still carry the
-updates-disabled defaults:
+than a release step. The checked-in native projects embed the production updates
+configuration:
 
-- `ios/Sauci/Supporting/Expo.plist`: `EXUpdatesEnabled` is `false`.
-- `android/app/src/main/AndroidManifest.xml`: `expo.modules.updates.ENABLED` is
-  `false`.
+- `ios/Sauci/Supporting/Expo.plist` enables updates and contains the manifest
+  URL, runtime version, request headers, code-signing metadata, and public
+  certificate.
+- `android/app/src/main/AndroidManifest.xml` enables updates and contains the
+  same production configuration; `android/app/src/main/res/values/strings.xml`
+  supplies its resolved runtime version.
 
-The `expo-updates` config plugin writes the URL, the resolved runtime version,
-the request headers, the code-signing metadata, and the certificate contents into
-these files. Those values embed the real app id and certificate, so the native
-projects are deliberately left untouched until both land.
-
-With the real app id and certificate now committed, regenerate and commit the
-native projects as a reviewed source change:
+The `expo-updates` config plugin wrote those values from the dynamic config as a
+reviewed source change. When future changes intentionally affect native config,
+regenerate and review the native diff separately:
 
 ```bash
 cd apps/mobile
 RELEASE_CHANNEL=production npx expo prebuild
-git diff   # expect only expo-updates related native changes
+git diff   # retain only reviewed expo-updates native changes
 ```
 
-A build produced before that prebuild will not check for updates.
+A build produced before this native source change will not check for updates.
 
 ## Publishing an update
 
@@ -199,7 +198,7 @@ production deploy and none of the review latency.
 curl -sD - "https://ota.apps.jbrunton.co.uk/manifest" \
   -H "expo-app-id: <xprem-app-id>" \
   -H "expo-channel-name: production" \
-  -H "expo-runtime-version: 1.0.6" \
+  -H "expo-runtime-version: 1.0.7" \
   -H "expo-platform: ios"
 ```
 
@@ -238,6 +237,5 @@ documented in the homelab repo (`unraid/docs/xprem-ota.md`).
 | Publish token | `XPREM_SAUCI_API_KEY` in the homelab repo `.env`; export as `EOO_TOKEN` when publishing |
 | Channels | `staging` and `production` created server-side, mapped 1:1 to branches of the same names. `development` intentionally has no server channel — dev clients run with `DISABLE_CODE_SIGNING=1` against the packager |
 
-Remaining before updates flow: run the prebuild described in
-[Native projects](#native-projects), commit the native diff, and cut a new store
-build. Only builds produced after that point can receive updates.
+Remaining before updates flow: cut a new store build from this checked-in native
+source. Only builds produced after that point can receive updates.