capability check: a checkout without .entitlements is a warning about this checkout only (built from another branch?), naming the current branch and the local branches / worktrees that have an .entitlements file, never a claim about the build; the newest built IPA (highest build number) is read (codesign -d --entitlements on macOS, else the Mach-O signature's entitlements blob) and compared as 'uploaded build N'; without one the output says the App Store Connect API does not expose a build's entitlements; exportedIpas moved to cli/lib/xcode.ts; pitfall 67; tests

CHANGELOG.md

@@ -12,6 +12,11 @@
   compare the App ID, `apple.signing.capabilities` and the iOS project's `.entitlements` (push, Game Center,
   associated domains, Sign in with Apple, iCloud, app groups, ...; also an entitlements file not set in
   CODE_SIGN_ENTITLEMENTS) and name what is missing where.
+- **No false alarm for entitlements on another branch.** A checkout without `.entitlements` is a warning about this
+  checkout only ("built from another branch?"), naming the current branch and the local branches / worktrees that
+  have one; it never claims the build lacks them. With a built IPA in build/ios/export, its real entitlements
+  (codesign, or the Mach-O signature when codesign is missing) are compared as "uploaded build N"; without one the
+  output says the App Store Connect API does not expose a build's entitlements.
 - **`storebound api` writes outside a terminal** say that they need an interactive terminal by design and name the
   dedicated command for common operations (bundle id capabilities: `apple signing ensure`, IAPs, listing, ...).
 - **`--json` prints only JSON on stdout.** Every command run with `--json` sends its log, step and table lines to