Handle uploaded but unassigned TestFlight builds

[zachyzissou]

Problem

Build 100 is VALID in App Store Connect but assigned to no beta group, while build 62 is the visible internal TestFlight build. This creates confusion and can leave valid builds invisible to testers.

Acceptance criteria

• Detect VALID builds with no internal beta group assignment.
• Decide whether the automation can assign internal groups or must report owner action.
• Show latest visible internal build separately from latest uploaded build.
• Add a release checklist step to verify tester visibility before declaring a build shipped.

Agent execution contract

Readiness: agent:senior-required
Lane: TestFlight visibility

Start in these files:

• scripts/app_store_connect.py
• CONTRIBUTING.md
• docs/*

Required verification:

• App Store Connect build/group query showing uploaded vs internal-visible builds.

Non-goals / guardrails:

• Do not claim VALID uploaded builds are shipped without group assignment.

PR expectation: Senior release tooling/docs PR with ASC evidence.

Low-thinking agents must follow docs/AGENT_EXECUTION_RUNBOOK.md. If the touched code falls outside the files above, stop and tighten the issue or ask for senior review before continuing.

[zachyzissou]

Status: senior-required, release-tooling cluster

This issue plus #104, #117, #121 (and tangentially #38) are really one piece of work: "make release/build visibility honest, automated, and recoverable." All four require ASC API key access and authority to mutate Xcode Cloud workflow configuration.

These can't move without owner action; consider grouping them into a single milestone ("Release Lane") and tackling them together in one focused session.

Discovered while reviewing the kanban post-session 2026-04-30.