Automate protected TestFlight beta releases - #33

What changed

• adds a separate GitHub-hosted TestFlight release workflow for future prereleases
• splits upload, beta-review submission, tester notification, and read-only verification into explicit protected operations
• persists upload and notification claims in a private append-only Git ledger so runner restarts cannot repeat one-shot App Store Connect actions
• verifies exact release source, signing identity, provisioning profiles, IPA contents, build audience, review state, and notification receipt
• adds executable workflow, ledger-concurrency, phase, signing, and notification contracts
• documents the environment, credential, ledger, export-compliance, and recovery prerequisites

Why

The existing TestFlight lane depended on durable local mode-400 records and could not safely run on an ephemeral GitHub-hosted macOS runner. This change adds a create-only private ledger and fail-closed state matrix while preserving the existing no-retry guarantees.

This workflow is intentionally future-release-only. It rejects v0.1.0/build 18 and v0.1.1/build 19; those releases predate the hosted workflow.

Validation

• full make check passed in the pre-push hook
• ShellCheck 0.11.0 and actionlint 1.7.12 passed
• all TestFlight workflow, ledger, phase, signing, audience, provenance, and notification contracts passed
• concurrent create-only ledger race passed repeatedly with exactly one winner
• Git-hook isolation regression proves caller config, index, objects, and worktree remain unchanged

Not enabled by this PR

No Apple credential, IPA, App Store Connect mutation, GitHub environment, private ledger repository, or ledger ruleset is created here. Live rollout still requires an explicitly approved private ledger and protected testflight-external environment.