Fastlane CI on GitHub Actions

Fastlane lanes spend most of their time on bundle install and signing setup.

Why it happens

The Ruby gem cache and the signing keychain are recreated on every run.

What to change

1. Cache vendor/bundle for the Fastlane gems
2. Use match with a read-only role in CI so certificates are fetched, not regenerated
3. Split build and upload into separate lanes so a failed upload does not rebuild

Fastlane on runnerhut

jobs:
  release:
    runs-on: runnerhut-macos-15-m4
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with: { bundler-cache: true }
      - run: bundle exec fastlane beta

The only runnerhut-specific line is `runs-on: runnerhut-macos-15-m4`. Everything else is standard GitHub Actions — the same actions, the same secrets and the same permissions model you use today.