ci: keep the synthesised macOS SDK symlink out of the dependency directory

libobs now builds AND installs cleanly on macOS -- libobs.framework, its
headers, and libobsConfig/libobsTargets all land. The configure then fell over
one step later, in the template's own quarantine-clearing step:

  xattr: [Errno 13] Permission denied:
    '.../.deps/sdk/MacOSX.platform/Developer/SDKs/MacOSX26.5.sdk'

`xattr -r -d com.apple.quarantine "${dependencies_dir}"` recurses, so it
followed the SDK symlink into the read-only system SDK. The symlink moves to
the build directory, where that sweep never reaches it. The xattr call itself
also stops being fatal: clearing quarantine on downloaded dependencies is a
convenience, and it should not be able to take the whole configure down.

Separately, in the adapter: the last-frame-geometry marker is cleared whenever
the session leaves Connected, so the next stream logs its first frame again.
Verified in the headless libobs harness by switching the selected camera to a
dark slot and back -- previously the switch back was silent because the
resolution had not changed, so the log stopped answering "did video come
back". It now reads:

  connected to ws://... watching cam-test
  video frame 640x360 I420
  --- switching camera to 'other-cam'
  connected to ws://... watching other-cam
  --- switching camera back to 'cam-test'
  connected to ws://... watching cam-test
  video frame 640x360 I420
  status after switch-back: connected

which also confirms the whole change-settings path: each switch mints a fresh
obs:<room>:<nonce> identity and reconnects, with no crash and no stale frame.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RL8abRmgFXkVASHkkqiJbE

cmake/common/buildspec_common.cmake

@@ -92,9 +92,10 @@ endfunction()
 # resolves the sysroot eagerly and the regex runs against a real path.
 #
 # So: if the toolchain's own SDK path already matches, use it untouched.
-# Otherwise build a symlink tree under .deps/ whose shape matches the regex
-# and which points at exactly the same SDK. Nothing about the compilation
-# changes -- only the spelling of the path, which is all the check reads.
+# Otherwise build a symlink tree under the build directory whose shape matches
+# the regex and which points at exactly the same SDK. Nothing about the
+# compilation changes -- only the spelling of the path, which is all the check
+# reads.
 function(_resolve_versioned_macos_sdk out_path)
   set(${out_path} "" PARENT_SCOPE)
 
@@ -128,7 +129,11 @@ function(_resolve_versioned_macos_sdk out_path)
   endif()
   set(_short "${CMAKE_MATCH_1}.${CMAKE_MATCH_2}")
 
-  set(_link_dir "${dependencies_dir}/sdk/MacOSX.platform/Developer/SDKs")
+  # Deliberately under the BUILD directory, not .deps/: cmake/macos/
+  # buildspec.cmake runs `xattr -r -d com.apple.quarantine` over the whole
+  # dependency directory, which would follow this symlink into the read-only
+  # system SDK and fail with "Permission denied".
+  set(_link_dir "${CMAKE_BINARY_DIR}/macos-sdk/MacOSX.platform/Developer/SDKs")
   set(_link "${_link_dir}/MacOSX${_short}.sdk")
   file(MAKE_DIRECTORY "${_link_dir}")
   if(NOT EXISTS "${_link}")