[eas-cli] Keep linked capability identifiers when syncing another one

[ceydaakin]

Why

Fixes #4445.

When a bundle ID already has App Group A linked and the entitlements list both A and B, capability sync sends only B in the relationship update. The update replaces the linked identifiers, so A is unlinked and the provisioning profile no longer satisfies the app's entitlements. The same code path handles Merchant IDs and iCloud containers.

How

syncCapabilityIdentifiersForEntitlementsAsync skipped identifiers that were already linked when building the relationship list. It now sends every identifier from the entitlements, and only issues an update when at least one of them is not linked yet. The linked and created results it returns are unchanged, so the CLI output is the same.

Test Plan

• Added a test with group.expo already linked and group.bacon new: the update must contain both. It fails on main (only XXX-group-2 is sent) and passes with this change.
• The existing tests still cover the "everything already linked, no update" case.
• yarn jest src/credentials/ios/appstore in packages/eas-cli: 76 tests pass. oxlint and oxfmt --check are clean.

I did not run this against the Apple Developer API. That the update replaces the linked identifiers is taken from the issue report and from the existing test, which expects an identifier missing from the entitlements to be dropped.

[github-actions]

Subscribed to pull request

File Patterns	Mentions
packages/eas-cli/**	@douglowder

Generated by CodeMention

Warning: The preamble and epilogue options in commentConfiguration are deprecated. Use template instead.

[douglowder]

eas-cli now uses changesets for changelogs (#4580). The required "Check for a changeset" check fails on PRs that edit CHANGELOG.md.

To update this PR:

1. Revert the changes to CHANGELOG.md.
2. Run yarn changeset, select the changed packages and the bump type, and write the summary.
3. Commit the new file in .changeset/.

The release adds the PR link and the author to the entry. If this PR needs no changelog entry, revert the CHANGELOG.md changes and add the "no changelog" label.

[ceydaakin]

@douglowder Thanks, done. I reverted the CHANGELOG.md changes and added .changeset/capability-sync-keeps-linked-identifiers.md (eas-cli: patch).