fix(ios): harden beta release prep

scripts/ios-write-version-xcconfig.sh

@@ -15,10 +15,34 @@ EOF
 
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 IOS_DIR="${ROOT_DIR}/apps/ios"
+BUILD_DIR="${IOS_DIR}/build"
 VERSION_XCCONFIG="${IOS_DIR}/build/Version.xcconfig"
 PACKAGE_VERSION="$(cd "${ROOT_DIR}" && node -p "require('./package.json').version" 2>/dev/null || true)"
 BUILD_NUMBER=""
 
+prepare_build_dir() {
+  if [[ -L "${BUILD_DIR}" ]]; then
+    echo "Refusing to use symlinked build directory: ${BUILD_DIR}" >&2
+    exit 1
+  fi
+
+  mkdir -p "${BUILD_DIR}"
+}
+
+write_generated_file() {
+  local output_path="$1"
+  local tmp_file=""
+
+  if [[ -e "${output_path}" && -L "${output_path}" ]]; then
+    echo "Refusing to overwrite symlinked file: ${output_path}" >&2
+    exit 1
+  fi
+
+  tmp_file="$(mktemp "${output_path}.XXXXXX")"
+  cat >"${tmp_file}"
+  mv -f "${tmp_file}" "${output_path}"
+}
+
 while [[ $# -gt 0 ]]; do
   case "$1" in
     --)
@@ -62,9 +86,9 @@ if [[ ! "${BUILD_NUMBER}" =~ ^[0-9]+$ ]]; then
   exit 1
 fi
 
-mkdir -p "${IOS_DIR}/build"
+prepare_build_dir
 
-cat >"${VERSION_XCCONFIG}" <<EOF
+write_generated_file "${VERSION_XCCONFIG}" <<EOF
 // Auto-generated by scripts/ios-write-version-xcconfig.sh.
 // Local version override; do not commit.
 OPENCLAW_GATEWAY_VERSION = ${PACKAGE_VERSION}