feat: archive_and_upload.py — TestFlight pipeline

[conorluddy]

Problem

"Cut a TestFlight build" is a 5-step ritual: archive → export → upload → wait → check processing status. High value to automate, but high risk because of credential handling.

Sketch

python scripts/archive_and_upload.py \
  --project MyApp.xcodeproj \
  --scheme MyApp \
  --export-options ExportOptions.plist \
  --api-key-path ./AuthKey.p8 \
  --upload

Wraps xcodebuild archive → xcodebuild -exportArchive → xcrun notarytool / App Store Connect API upload.

Reuses

• xcode/builder.py for subprocess + timeout patterns
• common/env_config.env_int for upload/archive timeouts

Open questions

• Credential story: keychain vs env vars vs file path. App Store Connect API keys (.p8) are the modern path.
• altool is being phased out — prefer notarytool and App Store Connect API directly.
• Out of scope: provisioning profile fetching, certificate management.

Definition of done

• Archive + export + upload pipeline works end-to-end on a test app
• Credentials documented + safe default (no echo)
• --dry-run flag for CI sanity checks
• SKILL.md updated

Part of the v2.0 coverage expansion epic.