fix: force sigh to renew provisioning profiles against current certs

Archive failed with 'Provisioning profile ... doesn't include signing
certificate iPhone Distribution: Loverde Company LTDA (K4E5BZMM4V)' for
both the app and NotificationServiceExtension targets, once ASC auth
itself was working. Without force: true, get_provisioning_profile just
downloads whatever profile already exists on Apple's servers as-is -
this CI keychain's distribution certificate differs from whatever the
existing profiles were last generated against. force: true makes sigh
regenerate them against the team's currently valid certificates.

fastlane/Fastfile

@@ -37,7 +37,17 @@ end
 lane :beta do |options|
   desc "Build and upload to TestFlight"
 
-  get_provisioning_profile(api_key_path: "fastlane/apikey.json")
+  # force: true - without it, sigh just downloads whatever profile
+  # already exists on Apple's servers as-is. This CI keychain's
+  # distribution certificate is a different one than whatever the
+  # existing profile was last generated against, so a plain (non-forced)
+  # fetch produced a profile that doesn't include this machine's cert -
+  # "Provisioning profile ... doesn't include signing certificate
+  # 'iPhone Distribution: Loverde Company LTDA (K4E5BZMM4V)'" at archive
+  # time. Forcing a renewal makes sigh regenerate the profile against
+  # the team's currently valid certificates instead of reusing a stale
+  # one.
+  get_provisioning_profile(api_key_path: "fastlane/apikey.json", force: true)
 
   assemble
 
@@ -55,7 +65,17 @@ lane :release do |options|
 
   # if you have an apikey.json file (https://developer.apple.com/documentation/appstoreconnectapi/creating-api-keys-for-app-store-connect-api), fastlane can automatically fetch certificates and the ASC authentication information
   #get_certificates(api_key_path: "fastlane/apikey.json")
-  get_provisioning_profile(api_key_path: "fastlane/apikey.json")
+  # force: true - without it, sigh just downloads whatever profile
+  # already exists on Apple's servers as-is. This CI keychain's
+  # distribution certificate is a different one than whatever the
+  # existing profile was last generated against, so a plain (non-forced)
+  # fetch produced a profile that doesn't include this machine's cert -
+  # "Provisioning profile ... doesn't include signing certificate
+  # 'iPhone Distribution: Loverde Company LTDA (K4E5BZMM4V)'" at archive
+  # time. Forcing a renewal makes sigh regenerate the profile against
+  # the team's currently valid certificates instead of reusing a stale
+  # one.
+  get_provisioning_profile(api_key_path: "fastlane/apikey.json", force: true)
 
   assemble