Validate signing credentials on a schedule without publishing

Signing certificates, provisioning profiles and store API keys expire. Finding out during a
release is expensive; finding out on a Tuesday is not.

A scheduled job should authenticate against each distribution path and validate the
credentials without building or publishing anything, then materialise and remove any
credential files it needed. Its latest result feeds the pull request summary in #692, so the
state is visible before someone tries to ship.

Steps

• Scheduled job authenticates and validates per platform
• No build and no publish in that path
• Credential files removed at the end of the job
• Latest result surfaced in the pull request summary

Done when

Credential expiry is discovered by a schedule rather than by a failed release.