Fix native Apple metadata plans without signing profiles

[PrzemyslawKlys]

A native .NET Mac App Store target can refresh app information or inspect release state without its local signing profile. These actions previously failed while hashing archive-only inputs, even when Archive was false. This blocked the privacy-URL metadata refresh for OfficeIMO.

Keep all referenced publish configuration files bound to the plan, and include entitlements, icons, provisioning profiles, and notices when the action builds an archive. Archive, upload, rehearsal, advance, and ship actions retain their signing-input checks; existing-archive uploads retain their archive identity and snapshot checks.

Validation: 14 focused native Apple, app-info metadata, and source-bound metadata tests pass. New coverage exercises configured metadata, Status, and Prepare without a signing profile and confirms that Archive still rejects the missing profile. An independent read-only review traced archive and upload-existing safety and found no blocking defects.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[chatgpt-codex-connector]

The account paying for this security review has reached its Codex usage limits. The payer can check the Codex usage dashboard. For personal accounts, using credits requires enabling “Use credits for security reviews” in Code review settings. If you do not manage the paying account, contact this repository's admins.