ci: add internal TestFlight releases

[enaboapps]

Summary

• configure the existing iOS identity with the Apple team and export-compliance declaration
• add an exact-tag, manually signed internal TestFlight workflow with safe Beta 11 backfill support
• add a dependency-free App Store Connect JWT/build-state helper with sanitized errors and idempotent polling
• serialize same-tag releases and verify both build ordinal and marketing version before treating an upload as complete
• document Apple records, repository secrets, credential renewal, and the dual Play/TestFlight release procedure

Validation

• npm run validate (43 suites, 312 tests)
• clean npx expo prebuild --clean --platform ios --no-install
• pod install
• unsigned Xcode 26.6 simulator build (BUILD SUCCEEDED)
• generated Info.plist contains ITSAppUsesNonExemptEncryption = false
• generated Xcode project contains team 4N2QY254XW and bundle ID com.enaboapps.switchify.remote
• workflow YAML parse and Prettier checks
• secret-pattern scan found no committed signing material

Account setup

• Apple Developer Program agreement accepted
• App ID, distribution certificate, provisioning profile, App Store Connect app/group, repository secrets, and signed archive validation remain pending action-time confirmation
• Set up App Store Connect and internal TestFlight CI #90 remains open as the post-merge TestFlight processing and physical iPad smoke-test tracker

Closes #92
Tracks #90

[enaboapps]

Independent latest-head review completed at ce4296d: no actionable findings remain. The reviewer confirmed same-tag serialization, marketing-version/build-ordinal matching, and separation of preparation issue #92 from post-merge tracker #90.

[enaboapps]

Local Apple validation is complete for the latest head (ce4296d):

• App Store Connect app 6804424631 exists for com.enaboapps.switchify.remote.
• Internal group Switchify Internal exists with automatic distribution enabled and one Account Holder tester.
• English (U.K.) TestFlight metadata persists after reload with the configured feedback email and privacy-policy URL.
• A clean Expo iOS prebuild and CocoaPods install completed.
• Signed Release archive succeeded with Apple Distribution: Owen McGirr (4N2QY254XW) and profile Switchify Remote App Store.
• IPA export succeeded.
• Verified bundle ID com.enaboapps.switchify.remote, version 1.0.0, build 13, ITSAppUsesNonExemptEncryption=false, and application identifier 4N2QY254XW.com.enaboapps.switchify.remote.
• xcrun altool --validate-app reported VERIFY SUCCEEDED with no errors; no upload was performed.
• Temporary validation credentials and extracted payloads were removed afterward.

Repository CI is green for validate, Android native generation/build, and iOS native generation/build. Independent latest-head review found no actionable issues. The PR remains draft and unmerged pending explicit approval.