feat(mobile-infra): support development App Attest (#7744)

Development-signed iOS apps cannot enroll with the current gateway
because their Apple App Attest AAGUID is rejected.

Add an explicit personal development build feature and environment
setting so a development gateway can use a developer's own application
identity and sandbox APNs credentials.

Ordinary gateway builds remain production-only. Special builds also
default to production, enforce exactly the selected signed AAGUID, and
retain certificate-chain, pinned-root, nonce, app-ID, key,
credential-ID, and counter verification.

Document the matching mobile signing configuration and expose the
feature through an optional Docker build argument.

### Validation

The development image deployed successfully to a personal Railway stack;
private readiness, enrollment challenges, authenticated relay access,
and APNs sandbox TLS/HTTP2 connectivity passed.

Signed-off-by: Tom Brow <tomb@block.xyz>

.github/workflows/docker.yml

@@ -569,6 +569,39 @@ jobs:
           if-no-files-found: error
           retention-days: 1
 
+  push-gateway-personal-dev:
+    name: Build personal development push gateway
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - name: Build personal development image without publishing
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: ./Dockerfile.push-gateway
+          platforms: linux/amd64
+          build-args: BUZZ_PUSH_CARGO_FEATURES=personal-dev-app-attest
+          load: true
+          tags: buzz-push-gateway:personal-dev-test
+          cache-from: type=gha,scope=push-gateway-personal-dev
+          cache-to: type=gha,scope=push-gateway-personal-dev,mode=max
+      - name: Verify runtime dependencies and startup
+        run: |
+          set +e
+          output=$(docker run --rm buzz-push-gateway:personal-dev-test 2>&1)
+          status=$?
+          set -e
+          test "$status" -eq 1
+          [[ "$output" == *'Missing("BUZZ_PUSH_GRANT_KEYS")'* ]]
+
   push-gateway-merge:
     name: Publish public push gateway image
     if: github.event_name != 'pull_request'