Fix App Store Connect API key JSON for fastlane

fastlane's Token.from_json_file requires the .p8 contents inline under a
"key" field (PEM with embedded newlines), but the JSON used "key_filepath"
(a path), so spaceship failed with "missing field(s): key" at login.

Decode the .p8 and write its contents into "key", built with jq so the PEM
newlines are escaped correctly. No longer writes the raw .p8 to disk.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/build-submit-ios.yml

@@ -229,10 +229,16 @@ jobs:
         run: |
           # Ensure the API key material is removed even if fastlane exits non-zero
           # (the step runs under `bash -e`, which would otherwise abort before cleanup).
-          trap 'rm -f asc_api_key.p8 asc_api_key.json' EXIT
-          echo "$ASC_KEY_P8_BASE64" | base64 --decode > asc_api_key.p8
-          printf '{"key_id":"%s","issuer_id":"%s","key_filepath":"%s","in_house":false}' \
-            "$ASC_KEY_ID" "$ASC_ISSUER_ID" "$PWD/asc_api_key.p8" > asc_api_key.json
+          trap 'rm -f asc_api_key.json' EXIT
+          # fastlane's Token.from_json_file expects the .p8 contents inline under "key"
+          # (PEM with embedded newlines), not a path. jq handles the newline escaping.
+          key_content="$(echo "$ASC_KEY_P8_BASE64" | base64 --decode)"
+          jq -n \
+            --arg key_id "$ASC_KEY_ID" \
+            --arg issuer_id "$ASC_ISSUER_ID" \
+            --arg key "$key_content" \
+            '{key_id: $key_id, issuer_id: $issuer_id, key: $key, in_house: false}' \
+            > asc_api_key.json
           changelog_args=()
           if [ -n "$RELEASE_NOTES" ]; then
             changelog_args=(changelog:"$RELEASE_NOTES")