ci(release): publish the unsigned iOS .ipa

The release calls ios.yml after the version check, as it does android.yml,
and attaches proton-stream-<version>-ios.ipa next to the other artifacts and
in SHA256SUMS.

.github/workflows/release.yml

@@ -150,10 +150,17 @@ jobs:
       signed_release: true
     secrets: inherit
 
+  # The unsigned .ipa: SideStore and AltStore re-sign it with the viewer's own
+  # Apple ID when they install it.
+  ios:
+    name: iOS
+    needs: verify
+    uses: ./.github/workflows/ios.yml
+
   publish:
     name: Publish
     if: startsWith(github.ref, 'refs/tags/')
-    needs: [linux, windows, android]
+    needs: [linux, windows, android, ios]
     runs-on: ubuntu-24.04
     permissions:
       contents: write
@@ -172,6 +179,10 @@ jobs:
         with:
           name: android
           path: artifacts
+      - uses: actions/download-artifact@v8
+        with:
+          name: ios
+          path: artifacts
 
       - name: Checksums
         run: |

docs/IOS.md

@@ -50,8 +50,8 @@ gets few app IDs, and each extension costs one.
 
 `.github/workflows/ios.yml` runs the tests and builds the `.ipa` on `macos-15` for
 every push to `main` and every pull request that touches the iOS sources or the Rust
-crates under them. It is not yet part of `release.yml`: add it there, and the `ios`
+crates under them. `release.yml` calls it too, and publishes the `.ipa` next to the
-artifact to `publish`, once it has passed on `main`.
+other artifacts.
 
 `scripts/render-ios-icon.sh` renders `ios/ProtonStream/Resources/AppIcon.svg`, which
 is Android's adaptive launcher icon with both layers on one canvas, into the asset