Complete SSH transport release audit (#118)

apple/AppStore/DISTRIBUTION.md

@@ -4,6 +4,13 @@ Use `distribution/` only as ignored local staging. Never store Apple credentials
 signing material, review credentials, GPG material, application tokens, or
 private diagnostics in the repository or release logs.
 
+The Apple Rust bridge intentionally excludes the optional storage `ssh`
+feature. Before archiving, confirm `cargo tree -p ironstorage-apple -i russh -e
+features` reports no matching package. Do not enable SSH for an Apple archive
+without a separate Apple host-trust/key-interaction design; the CLI, TUI, and
+desktop release artifacts enable SSH independently. The reviewed contract is
+recorded in `../../docs/ssh-transport-audit.md`.
+
 ## Release identity
 
 - iPhone application: `de.rfc1437.ironstorage`