Harden release build script

[sickn33]

Summary

• enable stricter shell handling with set -euo pipefail
• write the full xcodebuild release output to a log file
• keep showing filtered build/error/warning lines without masking the real xcodebuild exit status
• require DROPKIT_SIGNING_IDENTITY for normal release builds
• keep ad-hoc signing available only as an explicit local-test opt-in via DROPKIT_ALLOW_AD_HOC=1
• re-sign with the app entitlements and verify the final app signature

Why

The release script currently pipes xcodebuild through grep ... || true. That can hide build failures and let the script continue until a later artifact check, making the real failure harder to diagnose. It also produces ad-hoc-signed distribution artifacts by default. This keeps concise build output, preserves the actual build failure status, and makes proper release signing the default path.

Verification

• bash -n scripts/build-release.sh
• bash scripts/build-release.sh exits with the expected usage error when no version is provided
• bash scripts/build-release.sh 9.9.9 exits before build/cleanup when DROPKIT_SIGNING_IDENTITY is missing
• git diff --check

I did not run a full release build because the script intentionally cleans build output, clears extended attributes, signs, and creates distribution artifacts.