Add guarded Apple release workflows

[PrzemyslawKlys]

Summary

Adds reusable GitHub Actions building blocks for Apple releases so app repositories can keep their release wiring small and repeatable.

• installs an exact three-part PowerForge version from a SHA-256-verified standalone asset
• opens a reviewed version-bump PR from the authoritative version source
• advances upload, App Store preparation, screenshots, and configured TestFlight distribution without crossing review or release boundaries
• isolates TestFlight review, App Review, and release behind a separate protected workflow
• preserves compact plan and action receipts as separate required artifacts, including failure paths

The workflows verify immutable source and shared-tool commit SHAs, share one repository-wide Apple release lock, clean up temporary App Store Connect keys, and can resume a version branch after an interrupted PR-creation step.

Review and public release remain explicit actions. Nothing in this change merges a version PR, submits a build for review, or releases an approved version automatically.

Consumer shape

An app repository pins one published PowerForge version and checksum in .powerforge/powerforge.tool.json, then calls the reusable version, advance, or approval workflow at an exact commit SHA.

Validation

• 11 focused Apple release and workflow contracts
• PowerForge net472 build
• actionlint across all reusable workflows
• live read-only CasaRay status checks with relative and absolute project roots
• forced-failure receipt-path smoke check

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.