Watch: share with the complication through a Keychain group, not an App Group

Automatic signing with an App Store Connect API key registers bundle IDs and
profiles but cannot create or assign App Groups, so the archive failed. A
keychain-access-groups entry needs no portal setup. The demo flag and last
summary move into the same group; tests cover the round trip and the
migration of a pre-complication token.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

watch/WristCodeWidget/Info.plist

@@ -25,5 +25,7 @@
 		<key>NSExtensionPointIdentifier</key>
 		<string>com.apple.widgetkit-extension</string>
 	</dict>
+	<key>WristCodeKeychainGroup</key>
+	<string>$(AppIdentifierPrefix)org.gbrown.wristcode.shared</string>
 </dict>
 </plist>

watch/WristCodeWidget/WaitingWidget.swift

@@ -1,6 +1,6 @@
 // The watch face complication: how many threads are waiting on you, from `GET /v1/summary`. It
-// reads the device token from the shared Keychain group and the demo flag from the App Group, and
-// the app reloads it whenever its own feed or a notification changes the counts.
+// reads the device token and the demo flag from the shared Keychain group, and the app reloads it
+// whenever its own feed or a notification changes the counts.
 
 import SwiftUI
 import WidgetKit

watch/WristCodeWidget/WristCodeWidget.entitlements

@@ -2,9 +2,9 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>com.apple.security.application-groups</key>
+	<key>keychain-access-groups</key>
 	<array>
-		<string>group.org.gbrown.wristcode</string>
+		<string>$(AppIdentifierPrefix)org.gbrown.wristcode.shared</string>
 	</array>
 </dict>
 </plist>