chore: prepare TestFlight readiness

[ajbeck]

Decision

Start with TestFlight Internal Only for the first Quorra distribution pass. Apple documents this path as eligible for TestFlight team/internal testing while preventing that development build from being submitted to the App Store.

Move to TestFlight & App Store on a later archive when we are ready for external testers or App Store review. If a specific build is intended for external TestFlight or eventual App Store submission, that build should use TestFlight & App Store.

Scope

Prepare Quorra for the first internal TestFlight build and establish the release-readiness checklist for later App Store distribution.

Checklist

• Confirm App Store Connect app record for bundle ID dev.ajbeck.quorra
• Confirm Apple Developer Program/team access and cloud-managed signing
• Confirm marketing version and build number strategy
• Create a Release archive from Xcode
• Validate the archive in Xcode Organizer before upload
• Upload first build using TestFlight Internal Only
• Upload symbols so crash reports are symbolicated
• Retain the Xcode archive for diagnostics
• Inspect quorra.app signing, sandbox entitlements, hardened runtime, and keychain access group
• Inspect embedded quorra-cli presence, signing, sandbox entitlements, and keychain access group
• Verify app launch, setup folder bookmark flow, Identity Center sign-in, credential refresh, and local IMDS endpoint from the TestFlight-installed build
• Document any App Store review risks around local credential management, local network server behavior, and AWS credential handling

References

• Xcode documentation: Distributing your app for beta testing and releases
• Xcode documentation: Preparing your app for distribution
• Xcode documentation: Testing a release build

[ajbeck]

Created #3 to track the first usable quorra-cli surface. This is now a prerequisite/workstream for TestFlight readiness because the first internal build should validate that the embedded CLI is useful after installation and that signing, sandboxing, entitlements, and shared access assumptions hold.

[ajbeck]

Scope update: TestFlight readiness is app-first. The CLI has been removed from the app target and release scope; if we revisit command-line integration later, it should start from a fresh design issue rather than blocking TestFlight setup.