ci: only build iOS on new releases

iOS builds now only trigger when Release Please creates a new version,
not on every push. This prevents duplicate TestFlight uploads.

- release-please.yml: outputs release_created, calls build-ios-app
- build-ios-app.yml: changed from push trigger to workflow_call
- Manual dispatch still available for testing

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: pythoninthegrass

.github/workflows/build-ios-app.yml

@@ -1,19 +1,9 @@
 name: Build iOS App
 
 on:
-  push:
-    branches: ['main', 'master']
-    paths:
-      - 'src-tauri/**/*.rs'
-      - 'src-tauri/**/*.toml'
-      - 'src-tauri/dist/**'
-      - 'src-tauri/tauri.conf.json'
-      - 'src-tauri/gen/apple/**/*.swift'
-      - 'src-tauri/gen/apple/**/*.plist'
-      - 'fastlane/**'
-      - 'package.json'
-      - 'package-lock.json'
-      - '.github/workflows/build-ios-app.yml'
+  # Called by release-please when a new version is released
+  workflow_call:
+  # Manual trigger for testing
   workflow_dispatch:
 
 jobs:

.github/workflows/release-please.yml

@@ -11,14 +11,21 @@ permissions:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.release.outputs.release_created }}
+      tag_name: ${{ steps.release.outputs.tag_name }}
 
     steps:
       - name: Release with release-please
+        id: release
         uses: googleapis/release-please-action@v4
         with:
-          # PAT with write access to the repository
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
-          # optional. customize path to release-please-config.json
           config-file: release-please-config.json
-          # optional. customize path to .release-please-manifest.json
           manifest-file: .release-please-manifest.json
+
+  build-ios:
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    uses: ./.github/workflows/build-ios-app.yml
+    secrets: inherit