Document Mapbox token setup for mobile builds

[aisraelov]

Documents the two-token distinction (runtime pk. vs build-time sk. downloads token), where the downloads token must live (~/.netrc for iOS/SPM, MAPBOX_DOWNLOADS_TOKEN for Gradle and CI), the Navigation-SDK "active subscription required" gotcha, and account-custody guidance — written up after this week's orphaned-account fire drill where the only working downloads token belonged to a departed employee's personal Mapbox account.

---

Note

Low Risk
Documentation-only change to AGENTS.md with no runtime or build script modifications.

Overview
Adds a Mapbox tokens section to mobile/AGENTS.md so mobile contributors can distinguish the runtime public token (pk.… in EXPO_PUBLIC_MAPBOX_ACCESS_TOKEN) from the build-time downloads token (sk.…, Downloads:Read).

The new docs spell out where the secret must be configured: ~/.netrc for iOS/SPM, MAPBOX_DOWNLOADS_TOKEN for Android Gradle, and the same name as a GitHub Actions secret for CI. It also records operational gotchas—Navigation SDK dash-native 401s tied to an active billing/subscription, one-time display of secret values, and keeping tokens on a shared org Mapbox account rather than personal accounts.

^{Reviewed by Cursor Bugbot for commit bf4d2e6. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Document how to configure Mapbox tokens for mobile builds: distinguish runtime pk. vs build-time sk. downloads token and where to set each for iOS, Android, and CI. Also note the Navigation SDK requires an active subscription and recommend using a shared org Mapbox account for token custody.

• Migration
  • iOS: add to ~/.netrc — machine api.mapbox.com login mapbox password sk.…
  • Android/CI: set MAPBOX_DOWNLOADS_TOKEN for Gradle and in GitHub Actions
  • If Navigation SDK downloads return 401, ensure the org Mapbox account has an active Navigation subscription; store all tokens in the shared password manager under the org account

^{Written for commit bf4d2e6. Summary will update on new commits.}

[github-actions]

📋 PR Review Helper

📱 Mobile App Build

✅ Ready to test! (commit bf4d2e6)

📥 Download APK

🕶️ ASG Client Build

⏳ Waiting for build...

---

🔀 Test Locally

gh pr checkout 3407

[github-actions]

PR Agent Orchestrator State

{
  "cycle": 2,
  "fixRound": 0,
  "totalReviewerRuns": 2,
  "consecutiveNoNewReviews": 2,
  "openFindings": [],
  "resolvedFindings": [],
  "nitFindings": [],
  "phase": "discovery",
  "status": "in_progress",
  "lastPair": [],
  "stagnationFixRounds": 0,
  "lastOpenCount": 0,
  "fingerprintReopenCounts": {},
  "mutedFingerprints": []
}

[github-actions]

🤖 PR Agent Review — cycle 2

✅ No blocking findings · 0 blocking · 0 nits
Reviewers this cycle: none

No model reviews ran this cycle.

_{Updated automatically by the PR Agent Orchestrator each review cycle. Nits do not block merge.}