chore: pin geofence native SDK versions and sample test wiring

[mrehan27]

Summary

Wires the geofence feature to the native SDK versions that will ship it, and makes the sample apps buildable/testable against the pre-release native builds in the meantime.

Targets feature/geofence-on-device, not main. Nothing is released here. This keeps the geofence integration green and testable on the feature branch until the native SDKs are published.

⚠️ Read this first — two commits, one is temporary

Two intentional commits; please don't squash them in review:

Commit 1 — the real change we keep. Pins the native SDK versions that will contain geofence:

• android/build.gradle: cioVersion 4.18.2 → 4.20.0
• pubspec.yaml + Package.swift: native_sdk_version / SPM pin 4.5.3 → 4.7.0

These versions aren't published yet, which is why Commit 2 exists.

Commit 2 — temporary scaffolding so CI and reviewers can build/test the sample apps against pre-release native code, and so peers get a working feature build in the meantime:

• Android: cioVersion → feature-geofence-on-device-SNAPSHOT + the Sonatype Central snapshots repo
• iOS SPM: customerio-ios pinned to branch: feature/geofence-on-device
• iOS CocoaPods: load the geofence-aware override from the feature branch, install the non-production SDK from that branch, and add an explicit CustomerIO/LocationGeofence git pod (the umbrella subspec isn't on the released trunk spec yet)
• pubspec.yaml: temporarily pins native_sdk_version to 4.6.0 (the branch's current podspec version) so CocoaPods resolves — deliberately adjusts Commit 1's iOS bump, for testing only
• CI (reusable-build-sample-apps.yml): routes this PR's (working) primary-app build to the feature-branch Firebase distribution channel. The feature branch's own push builds fail to compile until the native geofence SDKs ship, so feature-build subscribers would otherwise get nothing — a small branch-gated addition to the distribution-group step gives them a working build in the interim (mirrors the equivalent React Native change).

Reverting Commit 2 restores Commit 1's production state exactly.

Note for reviewers & Bugbot

Commit 2 is temporary, test-only scaffolding and is reverted before merge — its changes never reach the feature branch. Please don't flag them as defects: the snapshot/branch pins, the native_sdk_version downgrade, the git pod, and the CI feature-branch distribution wiring.

Verified locally

• Android: sample builds against the feature-branch snapshot (debug APK produced).
• iOS CocoaPods: sample resolves + builds the geofence pods from the branch.
• iOS SPM: builds against the branch pin (local SPM had an environment-specific resolution hiccup; CI runs clean).

Merge plan

Commit 2 exists only so CI can build, reviewers can test, and feature-build subscribers get a working build while this PR is open. When the native geofence SDKs go live, Commit 2 is reverted entirely, so only Commit 1 lands on feature/geofence-on-device.

Ticket

https://linear.app/customerio/issue/MBL-1783/flutter-add-geofencing-support

---

Note

Medium Risk
Changes are labeled temporary and internal, but they alter dependency resolution (snapshot repo, git/branch pins) and CI distribution routing—easy to ship accidentally if the revert is missed.

Overview
Adds temporary pre-release wiring so geofence can be built and tested before published Android 4.20.0 / iOS 4.7.0 native SDKs ship. The PR description treats a separate commit as the long-term version pins; this diff is mostly the scaffolding that is meant to be reverted once natives are live.

Android (android/build.gradle): cioVersion moves from 4.18.2 to feature-geofence-on-device-SNAPSHOT, and Sonatype Central snapshots Maven is added so Gradle can resolve the unreleased artifacts.

iOS: SPM (Package.swift) pins customerio-ios to branch feature/geofence-on-device instead of an exact release. The CocoaPods sample loads the geofence override script from that branch, calls install_non_production_ios_sdk_git_branch, and adds a git CustomerIO/LocationGeofence pod because the umbrella subspec is not on the released trunk yet.

Plugin metadata: pubspec.yaml native_sdk_version is bumped 4.5.3 → 4.6.0 so CocoaPods resolution matches the branch podspec during testing.

CI (reusable-build-sample-apps.yml): for the primary sample app on Android and iOS jobs, builds from PR head branch mbl-1783-geofence-release are also published to the feature-branch Firebase distribution group so peers get installable builds while feature-branch pushes may not compile yet.

^{Reviewed by Cursor Bugbot for commit 48c2744. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Sample app builds 📱

Below you will find the list of the latest versions of the sample apps. It's recommended to always download the latest builds of the sample apps to accurately test the pull request.

---

• flutter_sample_spm: 358.2.0 (29726963)