fix(release): start Xcode Cloud from the Manual workflow default

Manual Archive workflows reject tags that are not in the start condition.
Require the Release commit SHA instead of starting on the Git tag.

.github/workflows/store-delivery.yml

@@ -309,8 +309,10 @@ jobs:
           test -n "$ASC_API_KEY_BASE64"
           python3 -m pip install --quiet PyJWT cryptography
           log_file="$RUNNER_TEMP/xcode-cloud-control.log"
+          # Manual Xcode Cloud workflows reject tags that are not in the start
+          # condition. Start the Archive workflow on its configured default
+          # (main) and require the immutable Release commit.
           python3 .edgeever-ci/scripts/xcode-cloud-control.py start \
-            --git-ref "refs/tags/${RELEASE_TAG}" \
             --require-sha "$(git rev-parse HEAD)" \
             --wait \
             --wait-valid |

docs/ios-xcode-cloud.md

@@ -91,8 +91,11 @@ Rules:
 ## Routine: ship a store binary
 
 Formal Releases do this automatically when `apps/ios` or the shared editor
-runtime changed: `bun run release` bumps `MARKETING_VERSION`, starts Xcode Cloud
-for the Release tag, waits until the build is **Valid**, and submits App Review.
+runtime changed: `bun run release` bumps `MARKETING_VERSION`, starts the Manual
+Xcode Cloud Archive workflow, requires the source commit to match the Release
+tag, waits until the build is **Valid**, and submits App Review. The Cloud
+workflow stays Manual, so Apple rejects starting it on a tag that is not in
+the start condition.
 
 To retry or ship iOS without a new GitHub Release:
 

docs/store-delivery.md

@@ -84,7 +84,7 @@ both runtimes changed:
 bun run publish:stores -- --release v1.7.0
 ```
 
-Deliver only iOS, starting Xcode Cloud for the Release tag:
+Deliver only iOS, starting the Manual Xcode Cloud Archive workflow:
 
 ```sh
 bun run publish:stores -- --release v1.7.0 --platform ios
@@ -140,7 +140,8 @@ Native iOS store binaries come from **`apps/ios`** (SwiftUI), not Expo EAS.
 On macOS beta hosts, archives must go through **Xcode Cloud** so
 `BuildMachineOSBuild` is a release OS image — see
 [iOS Xcode Cloud](ios-xcode-cloud.md). The store-delivery workflow starts that
-Archive workflow for the Release tag, waits until App Store Connect marks the
+Manual Archive workflow on its configured default branch, requires the source
+commit to match the Release tag, waits until App Store Connect marks the
 build Valid, then Fastlane (`apps/ios` `submit_review`) submits App Review and
 configures automatic release after approval. Pass `--ios-build-number` only to
 reuse an already uploaded build. Missing metadata, agreements, review

docs/store-delivery.zh-CN.md

@@ -73,7 +73,7 @@ EAS Submit 要求应用已经在对应商店中创建；Google Play API 提交
 bun run publish:stores -- --release v1.7.0
 ```
 
-只交付 iOS，并为该 Release tag 启动 Xcode Cloud：
+只交付 iOS，并启动手动触发的 Xcode Cloud Archive：
 
 ```sh
 bun run publish:stores -- --release v1.7.0 --platform ios
@@ -124,10 +124,11 @@ Release。默认命令直接使用 Production；只有明确要求测试交付
 原生 iOS 商店二进制来自 **`apps/ios`**（SwiftUI），不再走 Expo EAS。
 在 macOS beta 本机上，Archive 必须通过 **Xcode Cloud**，保证
 `BuildMachineOSBuild` 来自正式系统镜像——见
-[iOS Xcode Cloud](ios-xcode-cloud.md)。商店交付工作流会针对 Release tag 启动
-该 Archive，等到 App Store Connect 将构建标为 Valid，再用 Fastlane（`apps/ios`
-的 `submit_review`）提交 App Review，并设置为审核通过后自动发布。只有复用已经
-上传的构建时才传入 `--ios-build-number`。元数据、协议、审核信息或凭据不完整时
+[iOS Xcode Cloud](ios-xcode-cloud.md)。商店交付工作流会按 Archive 工作流配置的
+默认分支启动这次手动构建，并要求源提交与 Release tag 一致，等到 App Store
+Connect 将构建标为 Valid，再用 Fastlane（`apps/ios` 的 `submit_review`）提交
+App Review，并设置为审核通过后自动发布。只有复用已经上传的构建时才传入
+`--ios-build-number`。元数据、协议、审核信息或凭据不完整时
 工作流会失败，不会改为提交其他构建。
 
 商店列表本地化（含日文）存放在 `apps/mobile/store-assets/`，需在 App Store

scripts/store-delivery.test.mjs

@@ -76,6 +76,8 @@ describe("store delivery command", () => {
     );
     expect(workflow).toContain(".edgeever-ci/scripts/xcode-cloud-control.py");
     expect(workflow).toContain("--wait-valid");
+    expect(workflow).toContain("--require-sha");
+    expect(workflow).not.toContain("--git-ref");
     expect(workflow).toContain("grep -E '^(build_number|app_store_build_id|build_run_id|source_sha|processing_state)='");
     expect(workflow).toContain('refs/tags/${RELEASE_TAG}');
     expect(workflow).toContain(