fix(ioscompanion): resolve signing key path to absolute

xcodebuild's -authenticationKeyPath requires an absolute path, but .env
files commonly carry a repo-relative one. Resolve it against the working
directory before the stat so a relative ASC_API_KEY_PATH still signs.

internal/driver/ioscompanion/devicerunner.go

@@ -67,11 +67,15 @@ func readSigningCredentials() (signingCredentials, error) {
 	if len(missing) > 0 {
 		return creds, fmt.Errorf("device signing requires environment variables: %s", strings.Join(missing, ", "))
 	}
-	if creds.authKeyPath != "" {
+	// xcodebuild's -authenticationKeyPath demands an absolute path, but .env
+	// files commonly carry a repo-relative one. Resolve it against the working
+	// directory before the stat so a relative key still works.
+	if absolute, err := filepath.Abs(creds.authKeyPath); err == nil {
+		creds.authKeyPath = absolute
+	}
 	if _, err := os.Stat(creds.authKeyPath); err != nil {
 		return creds, fmt.Errorf("App Store Connect key not found at %s: %w", creds.authKeyPath, err)
 	}
-	}
 	return creds, nil
 }
 

internal/driver/ioscompanion/devicerunner_test.go

@@ -147,6 +147,25 @@ func TestReadSigningCredentialsAcceptsPresentKey(t *testing.T) {
 	}
 }
 
+func TestReadSigningCredentialsResolvesRelativeKeyPath(t *testing.T) {
+	dir := t.TempDir()
+	t.Chdir(dir)
+	if err := os.WriteFile("AuthKey.p8", []byte("key"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv(envTeam, "TEAM1")
+	t.Setenv(envAuthKeyID, "KID")
+	t.Setenv(envAuthIssuer, "ISS")
+	t.Setenv(envAuthKeyPath, "AuthKey.p8")
+	creds, err := readSigningCredentials()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !filepath.IsAbs(creds.authKeyPath) {
+		t.Fatalf("authKeyPath = %q, want an absolute path for xcodebuild", creds.authKeyPath)
+	}
+}
+
 func TestSourceHashChangesWithSources(t *testing.T) {
 	dir := t.TempDir()
 	if err := os.MkdirAll(filepath.Join(dir, "Sources"), 0o755); err != nil {