Automate TestFlight deployment in CI

[hisaac]

Automate uploading builds to TestFlight so testers can get them without a manual Xcode Organizer trip.
macOS apps are supported by TestFlight.

Prerequisite worth solving first

CI does not code sign today. The build script passes CODE_SIGN_IDENTITY= deliberately, which is
why the build emits:

CenterMouse isn't code signed but requires entitlements.

Nothing can be uploaded anywhere until CI has a real signing identity. That means a Developer ID /
Apple Distribution certificate and provisioning profile in the runner keychain, and an App Store
Connect API key — all as repository secrets. This is the bulk of the work; the upload itself is the
easy part.

Shape

• Archive (xcodebuild archive) rather than build.
• Export with an export options plist appropriate to App Store distribution.
• Upload with xcrun altool or notarytool + the App Store Connect API key.

Notes

• Build numbers must increase for every upload. CURRENT_PROJECT_VERSION is currently a hand-edited
  9, so decide whether CI derives it (run number, commit count) or the repo stays authoritative.
• Decide the trigger deliberately: every push to main will produce a lot of TestFlight builds.
• Keep secrets out of PR-triggered runs — forked PRs must not get access to signing material.