fix(release): accept Xcode Cloud builds whose iOS tree matches the tag

Manual Archive workflows build the default branch, which can move after the
Release commit. Compare apps/ios and packages/shared instead of requiring
an exact SHA.

.github/workflows/store-delivery.yml

@@ -311,15 +311,23 @@ jobs:
           log_file="$RUNNER_TEMP/xcode-cloud-control.log"
           # Manual Xcode Cloud workflows reject tags that are not in the start
           # condition. Start the Archive workflow on its configured default
-          # (main) and require the immutable Release commit.
+          # (main) and require the iOS runtime tree to match this Release.
           python3 .edgeever-ci/scripts/xcode-cloud-control.py start \
-            --require-sha "$(git rev-parse HEAD)" \
             --wait \
             --wait-valid |
             tee "$log_file"
           grep -E '^(build_number|app_store_build_id|build_run_id|source_sha|processing_state)=' \
             "$log_file" >> "$GITHUB_OUTPUT"
           test -n "$(grep -E '^build_number=' "$log_file")"
+          source_sha="$(grep -E '^source_sha=' "$log_file" | tail -1 | cut -d= -f2)"
+          test -n "$source_sha"
+          git fetch --no-tags origin "$source_sha"
+          changed="$(git diff --name-only "$source_sha" HEAD -- apps/ios packages/shared)"
+          if [[ -n "$changed" ]]; then
+            echo "Xcode Cloud source $source_sha differs from Release $(git rev-parse HEAD) in iOS runtime files:" >&2
+            echo "$changed" >&2
+            exit 1
+          fi
 
       - name: Load App Store release notes
         id: notes