Checklist

• I've run bundle exec rspec from the root directory to see all new and existing tests pass
• I've followed the fastlane code style and run bundle exec rubocop -a to ensure the code style is valid
• I see several green ci/circleci builds in the "All checks have passed" section of my PR
• I've read the Contribution Guidelines
• I've updated the documentation if necessary.
• I've added or updated relevant unit tests.

Motivation and Context

match_nuke exposes the certificate_id option, but the nuke flow did not use it when filtering certificates, provisioning profiles, or files.

As a result, running match_nuke with both force: true and a specific certificate_id could still list and revoke/delete every fetched certificate and matching provisioning profile, instead of only the selected certificate and profiles that depend on it.

Resolves #30015

Description

This change makes match_nuke honor certificate_id before the existing force behavior short-circuits certificate filtering.

When certificate_id is provided, match_nuke now:

• filters the fetched certificates down to the requested certificate ID
• filters provisioning profiles to only profiles associated with that certificate
• filters repository files to only the selected certificate/key files and matching provisioning profile files
• raises an explicit error if the requested certificate_id does not match any fetched certificate

I also added unit coverage for the force: true case reported in the issue, plus coverage for the invalid certificate_id path.

No documentation update was needed because certificate_id was already documented for match_nuke; this fixes the implementation to match the documented behavior.

Testing Steps

Added regression coverage that simulates the match_nuke environment from #30015:

• force: true
• certificate_id: "1111111111"
• two fetched certificates: 1111111111 and 2222222222
• one provisioning profile tied to each certificate
• stored .cer, .p12, and .mobileprovision files for both certificates/profiles

The spec calls filter_by_cert and verifies that only the selected certificate, its key, and its dependent provisioning profile remain queued for deletion. It also verifies that an unmatched certificate_id raises an explicit error.

Ran the focused match_nuke specs covering this change:

env -u NO_COLOR bundle exec rspec match/spec/nuke_spec.rb

Result:

3 examples, 0 failures

Ran RuboCop on the touched files:

env -u NO_COLOR RUBOCOP_CACHE_ROOT=/private/tmp/rubocop-cache bundle exec rubocop match/lib/match/nuke.rb match/spec/nuke_spec.rb

Result:

2 files inspected, no offenses detected

Ran the full RuboCop suite:

RUBOCOP_CACHE_ROOT=/private/tmp/rubocop-cache bundle exec rubocop

Result:

1313 files inspected, no offenses detected

Ran docs validation:

env -u NO_COLOR bundle exec fastlane validate_docs

Result: passed.