Automate App Store Connect release deployment in CI

[hisaac]

Automate submitting release builds to App Store Connect.

Depends on

The signing and API key work described in the TestFlight issue. Do that first — this is largely the
same pipeline with a different destination and a higher bar for getting it wrong.

Notes

• Trigger should be explicit and deliberate: a tag or a manual dispatch, not a push. An accidental
  submission is annoying to unwind.
• MARKETING_VERSION currently lives in Config/CenterMouse.xcconfig and is hand-edited. Decide
  whether the tag drives the version or the xcconfig does, and make one of them authoritative — two
  sources of truth for a version number is a reliable way to ship the wrong one.
• Submitting for review is a separate step from uploading. Consider whether automation should stop
  at "uploaded and ready to submit" rather than pushing to review unattended.
• The app is sandboxed and uses hardened runtime already, which is a good start for review.