feat(ship): the Apple App Store release journey — working tree to Submit for Review

Point /ship at a repo with an .xcodeproj, .xcworkspace, or app-product Swift
package and ask to release: the adapter runs the whole journey with ONE
authorization moment (membership + pricing + in-session sign-in, decision-
store persisted so repeat releases ask nothing) and one store-assets question
only when assets are missing. fastlane is the single tool (produce/cert/
sigh/gym/pilot/deliver/frameit); credential vocabulary never reaches the
user.

The adapter carries 21 live releases' worth of paid-for Apple knowledge:
the web session mints the permanent upload key itself (iris POST
/v1/apiKeys; privateKey is base64-of-PEM, downloadable only at creation) so
nobody ever types an app-specific password; error -22938 is Transporter
asking for a key, not a user task; errors are CLASSIFIED before credentials
are touched (validation/UnexpectedResponse = metadata, incl. Apple's
expanded age-rating attributes); pricing goes through POST
/v1/appPriceSchedules because fastlane's price_tier is broken against the
current API; and store distribution NEVER routes through the branch gate —
a clean tree on main is the solo shipper's normal case (Step 0.9 loads the
adapter BEFORE the gate, pinned by test with the non-Apple gate
byte-unchanged and unique). Uploads/submissions follow an idempotency-log
contract (inspect App Store Connect before any re-run). Non-Mac hosts get
the honest split: build legs via a macOS CI runner with the minted key as a
secret, API legs local. Browser use inside the journey is banned except the
named paid-app banking/tax residue. Redaction dry-run clean.

Ship's parity ratio raised 1.12 -> 1.22 deliberately: the 14.8KB section is
on-demand (Apple store targets only), one manifest line otherwise.

Ported from time-attack/gstack (GStack 2), refined across its 21 live
releases; architecture adaptation (carved section, decision-store paths,
idempotency log, third-party-actions handoff) ours.

Co-authored-by: Sina Matian <sina@time-attack.dev>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test/helpers/carve-guards.ts

@@ -99,6 +99,7 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
   ship: {
     skill: 'ship',
     expectedSections: [
+      'apple-release.md',
       'tests.md',
       'test-coverage.md',
       'plan-completion.md',
@@ -133,9 +134,12 @@ export const CARVE_GUARDS: Record<string, CarveGuard> = {
     // markers, test-file census — e3259078 port) + the #1079 gh pr edit REST
     // fallback grew the union to 1.090x; the third-party web-actions
     // contract (consent-gated browser drive for API-key registration etc.)
-    // adds ~2.3KB inline judgment, measured 1.103x. Kept tight; the Apple
-    // release adapter raises this again deliberately.
-    maxSizeRatio: 1.12,
+    // adds ~2.3KB inline judgment, measured 1.103x. The Apple release
+    // adapter (14.8KB carved section, 21 live releases of judgment — the
+    // wave's headline capability) grows the union to 1.195x. Deliberate:
+    // the section is on-demand (loads only for Apple store targets), so
+    // per-invocation cost for non-iOS ships is one manifest line.
+    maxSizeRatio: 1.22,
   },
   'plan-ceo-review': {
     skill: 'plan-ceo-review',