Add fastlane + GitHub Actions release automation

[adborbas]

Automates the release process from RELEASING.md with fastlane + GitHub Actions. Each step is a fastlane lane plus a workflow_dispatch workflow.

What's included

• cut_release (Cut Release workflow) — branch release/<version> from main and bump MARKETING_VERSION.
• beta (Release workflow) — sign via match, auto-bump the build number, archive, upload to TestFlight, and enable the build for the internal Testers group. Fails fast if MARKETING_VERSION is already released (closed TestFlight train).
• publish (Publish Release workflow) — tag v<version>, create the GitHub release, and open a back-merge PR to main.

Signing & secrets

• Signing via fastlane match; certs live encrypted in a private repo, fetched read-only on CI via an SSH deploy key.
• ASC API key, match passphrase, and deploy key are stored in the protected release environment (required reviewer). The Team ID is a repo variable, read from env / gitignored Local.xcconfig.
• No secrets or personal identifiers are committed (security-audited).

Access control

• Sensitive workflows (release, publish) run in the release environment (approval gate) and are guarded by if: github.actor == 'adborbas'.

Validation

• Verified end-to-end locally: real signed build uploaded to TestFlight and distributed to the Testers group.
• The version guard and group distribution were both exercised.
• fastlane pinned to 2.237.0.

Note

• The MARKETING_VERSION bump is intentionally not in this PR — start the next version via cut_release after merge.
• The release/publish CI paths (runner + deploy-key transport) run for the first time only after merge, since workflow_dispatch workflows must be on the default branch.

🤖 Generated with Claude Code