Watch: TestFlight archive, iOS stub container, testflight.sh

The App Store only accepts a watch-only app inside an empty iOS stub
(watchapp2-container), the pair Xcode's Watch-only App template makes.
The stub takes org.gbrown.wristcode; the watch app, and so the APNs topic,
becomes org.gbrown.wristcode.watchkitapp.

Adds ITSAppUsesNonExemptEncryption = NO and scripts/testflight.sh, which
archives with API key automatic signing and a timestamp build number,
then exports and uploads (or exports only with --no-upload).

Co-Authored-By: Claude Opus 5.5 <[email protected]>

watch/project.yml

@@ -11,6 +11,7 @@ settings:
     SWIFT_VERSION: "6.0"
     SWIFT_STRICT_CONCURRENCY: complete
     MARKETING_VERSION: "0.1.0"
+    # Default build number; scripts/testflight.sh overrides it with CURRENT_PROJECT_VERSION=<n>.
     CURRENT_PROJECT_VERSION: "1"
 targets:
   WristCode:
@@ -29,14 +30,37 @@ targets:
         # this and WKRunsIndependentlyOfCompanionApp, and requires WKCompanionAppBundleIdentifier
         # when WKRunsIndependentlyOfCompanionApp is set without WKWatchOnly.
         WKWatchOnly: true
+        # HTTPS only, so no export compliance documentation is needed.
+        ITSAppUsesNonExemptEncryption: false
     entitlements:
       path: WristCode/WristCode.entitlements
       properties:
+        # Archives are signed for development; exporting for App Store Connect re-signs with the
+        # distribution profile, which turns this into production.
         aps-environment: development
     settings:
       base:
-        PRODUCT_BUNDLE_IDENTIFIER: org.gbrown.wristcode
+        # The container's bundle ID plus .watchkitapp, as App Store validation requires. This is also
+        # the APNs topic.
+        PRODUCT_BUNDLE_IDENTIFIER: org.gbrown.wristcode.watchkitapp
         ASSETCATALOG_COMPILER_APPICON_NAME: AppIcon
+  # The App Store only takes a watch-only app inside an empty iOS stub, the same pair Xcode's
+  # "Watch-only App" template creates. The stub owns the App Store Connect record
+  # (org.gbrown.wristcode) and embeds the watch app; it never installs on an iPhone.
+  WristCodeContainer:
+    type: application.watchapp2-container
+    platform: iOS
+    deploymentTarget: "27.0"
+    dependencies:
+      - target: WristCode
+    settings:
+      base:
+        PRODUCT_NAME: WristCode
+        PRODUCT_BUNDLE_IDENTIFIER: org.gbrown.wristcode
+        GENERATE_INFOPLIST_FILE: YES
+        INFOPLIST_KEY_CFBundleDisplayName: WristCode
+        INFOPLIST_KEY_ITSAppUsesNonExemptEncryption: NO
+        TARGETED_DEVICE_FAMILY: "1"
   WristCodeTests:
     type: bundle.unit-test
     platform: watchOS
@@ -55,6 +79,7 @@ schemes:
     build:
       targets:
         WristCode: all
+        WristCodeContainer: [archive]
         WristCodeTests: [test]
     run:
       config: Debug