Apple release designed around the session-only baseline user (v1.64.5.0)

[time-attack]

Follow-up to #33, per the product owner's user story: 100% of gstack users start with an Apple ID and a just-paid $99 membership — no .p8, no app-specific password. The adapter previously treated the API key as the main road; this flips it.

• Upload step rewritten around session auth as the baseline: fastlane deliver/pilot on FASTLANE_SESSION (minted once by spaceauth; per fastlane's documented auth the session ALONE covers binary upload — the app-specific password is an alternative, not a requirement).
• Storefront completion picks its CLI by credential world: session-only → deliver end to end; .p8 holders → asc (JSON-first). One tool per credential world, never both in one release.
• Autonomy contract restated from the user story: one session mint (single 2FA, automatable via approved local code source), then app record, upload, metadata, TestFlight, and Submit — zero browser steps for a free app.

Test evidence: test:gstack2 gate green (parity 4,359), release-hardening 11/11.

🤖 Generated with Claude Code

---

Summary by cubic

Redesigned the Apple release flow around the baseline user: Apple ID + paid membership, no .p8 and no app-specific password. End-to-end upload, metadata, TestFlight, and submit now run on FASTLANE_SESSION; if an API key exists, storefront steps switch to asc (one tool per credential world).

• Refactors
  • Default path uses fastlane deliver/pilot with FASTLANE_SESSION minted by spaceauth (no app-specific password required).
  • Tool selection is explicit: session-only → deliver; API key → asc. Never mix both in one release.
  • Autonomy contract clarified: one session mint, then app record (asc web or produce), upload, metadata, TestFlight, and Submit—no browser for free apps.
  • Updated skills/ship/references/APPLE-RELEASE.md and generator text; bumped to 1.64.5.0 in package.json/VERSION.

^{Written for commit 905d996. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.