Document Xcode Cloud API fallback in appstore skill and bump checkout to v6

[ydesgagn]

Summary

Documents a workaround in the appstore skill for accessing Xcode Cloud build logs and failure details, which asc-mcp does not expose, and bumps the actions/checkout action used by the auto-merge workflow from v4 to v6.

The new skill section warns that a Xcode Cloud ciBuildRun ID is not a TestFlight build ID (so mcp__appstore__getBuild 404s on it), and provides a copy-paste bash fallback that mints an ES256 JWT from the existing ASC_* env vars and hits the App Store Connect API directly to fetch build actions, issues, log bundles, and .xcresult artifacts.

Key changes:

• Add "Xcode Cloud build logs / failures (MCP gap)" section to skills/appstore/SKILL.md explaining the MCP gap, the API key permission prerequisite, and a JWT + curl fallback workflow
• Include tips on JWT minting alternatives, short-lived pre-signed download URLs, and xcresulttool get --format json for extracting test failure details
• Bump actions/checkout from @v4 to @v6 in .github/workflows/auto-merge.yml

Types of changes

• Bugfix (fixes an issue)
• New feature (adds functionality)
• Refactoring (improves code without changing functionality)
• Breaking change (incompatible changes)
• Build or security update (updates dependencies, libraries, or security patches)
• Code style or documentation update (formatting, renaming, or documentation changes)
• Other (please describe):

Checklist

• Unit tests added to validate my fix/feature
• I have manually tested my change
• I did not add automation test. Why ?:
• Database changes requiring migration with downtime or reprocessing of existing data
• The SOUP file lists the risk Level, requirements and verification reasoning associated with each library
• readme.md includes sections on introduction, installation, usage, and contributing
• docs/architecture.md includes sections on the architecture diagram, software units, software of unknown provenance, critical algorithms and risk controls related to PII and security
• Impact on PII, privacy regulations (CCPA/GDPR/PIPEDA), CIS benchmarks or security (availability/confidentiality/integrity); management must be notified