validate: macOS versions need Mac screenshots, Play reads survive an ended edit; macOS build numbers across platforms; Mac build prebuild + apple.macAppCheck; signing wording off the Mac; dry flows plan uploads

skills/release-flows/SKILL.md

@@ -18,7 +18,7 @@ shell after the dry run).
 ```yaml
 description: Build, upload and check one version on both stores
 params:
-  VERSION: "1.0.0"            # flow run release VERSION=1.2.0 overrides
+  VERSION: "?"                # "?" = required: flow run release VERSION=1.2.0 (no silent default; --resume reuses the last run's)
 steps:
   - id: next-build
     if: apple                 # apple | play | exists <path> | ${VAR} | !${VAR} | ${A} == x; && joins
@@ -36,6 +36,10 @@ before: []                    # hooks: before / after the steps, onError when a
 after: []
 onError: []
 ```
+`${config.testflight.internal}` is filled by the runner with the internal groups of `apple.testflight.groups` (empty when
+none); the beta template uses it when `GROUP` is empty. The release template has optional steps by param: `MAC_TAURI=<src-tauri>`
+adds the macOS build + upload, `PLAY_TRACK=beta` uploads to Play open testing (default `internal`); its `promote` step is an
+owner step listing the Play promotion.
 `continueOnError: true` lets a step fail without stopping the flow.
 A web build before the native builds (Capacitor: `npm run build && npx cap sync`) belongs in `build.prebuild` in the
 config rather than an `sh:` step: `apple build` and `play build` run it themselves, and within one `flow run` it runs
@@ -44,7 +48,8 @@ once (the second build step prints "prebuild skipped (already ran in this flow r
 ## Modes
 - `flow run release VERSION=1.2.0` (default): read steps (check, validate, scan, release plan, next-build, status ...)
   run for real; **every write step runs with `--dry`**; wait steps check once; shell steps are skipped. Nothing
-  changes. Show this output to the owner.
+  changes. Show this output to the owner. A dry `apple build` / `play build` writes no IPA / AAB, so the upload after it
+  (and `apple testflight wait` / `distribute` after that) is shown as "planned" instead of failing; a real run is unchanged.
 - `--dry`: the plan only, nothing runs.
 - `--apply`: writes and shell steps run for real; each write command still asks its own confirmation in the
   terminal. Never add `--yes` to a step (flow validate refuses it).