Pluginfiles pull the plugin from git, so a runtime dependency would make
every pipeline install app-info (Ruby 3.1+) even when it only uploads
with app tokens. The gem is now loaded lazily for org-key uploads without
bundle_id; when it is missing the error says how to add it or to pass
bundle_id.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>