Session suffices for upload — no app-specific password demands (v1.64.13.0)

[time-attack]

Live nimbus round 7: the run stopped to demand an app-specific password, claiming Apple requires it for 2FA-account uploads. fastlane's own CI docs say either the ASP or a spaceauth session works — the session alone uploads via deliver/pilot. The guarantee sentence was lost in the v1.64.7.0 contract compression; this restores it and adds an attempt-first rule (credential fallback talk requires a real auth error from a real upload attempt, and preemptive ASP demands are a named violation). App Review contact info moves into the authorization moment + decision store instead of being a mid-run roadblock.

Test evidence: test:gstack2 gate green (parity 4,359).

🤖 Generated with Claude Code

---

Summary by cubic

Stop blocking Apple uploads by demanding an app-specific password. Use the existing spaceauth session, try upload first, and only ask for credentials if a real auth error occurs; also move App Review contact collection into the auth step and persist it.

• Bug Fixes
  • Restore “session suffices for upload” guarantee; no preemptive ASP demands.
  • Enforce attempt-first auth: try the cached session before any fallback.
  • Clarify that deliver/pilot work with the session alone; only ask for ASP after a real auth failure.
  • Collect and persist App Review contact details during authorization; remove mid-run prompts.

^{Written for commit cd29450. Summary will update on new commits.}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.