On push to main (with a manual approval gate via the production
environment), cloud-build and auto-submit iOS, tvOS and Android in
parallel:
- iOS: EAS-remote credentials, App Store Connect API key via EXPO_ASC_* env
- tvOS: local credentials.json + cert/profiles restored from secrets
- Android: AAB submitted with a Google Play service account key
Also adds the android submit profile in eas.json and ignores the
CI-injected google-service-account.json.
