Apple rejected build 2: NSPrivacyTracking was true with an empty
NSPrivacyTrackingDomains. Listing AdMob's ad-serving domains would block
ads before ATT consent (same domains serve non-personalized ads), so we
set NSPrivacyTracking=false and remove the domains key — mirroring
Google's own AdMob SDK manifest (DeviceID data type stays tracking=true,
no top-level tracking/domains). Bump to build 3.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>