bug(builds): add-groups returns raw 422 instead of a state preflight and actionable message

Summary

asc builds add-groups fails with a raw HTTP 422 for a large share of users. Telemetry (5.x, last 14 days): 142 distinct installs hit 422 on this command, 55 of them in the last 48 hours. It is the most common live failure in the dataset that is not already being fixed.

Likely cause

Apple rejects adding beta groups when the build is still processing, has not completed beta app review for external groups, is expired, or is missing export compliance. asc sends the request blind and surfaces Apple's 422 without saying which precondition failed.

Proposed fix

• Preflight the build before the POST: read processing state, expiration, and (for external groups) beta review state / encryption declaration.
• Return a usage or validation error (exit 2 or the documented validation code) naming the failing precondition and the command that fixes it (builds wait, encryption declarations assign-builds, testflight review submit).
• When Apple still returns 422, map its error detail into the message rather than a generic API error.

Acceptance criteria

• httptest fixtures for processing, expired, external-without-beta-review, and missing-encryption cases each produce a specific message and no POST
• real 422 from Apple keeps the exit code but prints the Apple detail
• telemetry classification moves these from raw 4xx to expected_negative or usage