Last I checked ICANN policy, upon request by the registrant, GoDaddy must provide the authcode and unlock within 5 calender days.
http://www.icann.org/en/transfers/policy-en.htm
(some portions of this may not applicable to every registrar, but is to most, since the vast majority, including GoDaddy, have agreed to the 2009 RAA)
Below is an excerpt - emphasis mine:
------
Instances when the requested change of Registrar
may not be denied include, but are not limited to:
* Nonpayment for a pending or future registration period
* No response from the Registered Name Holder or Administrative Contact.
* Domain name in Registrar Lock Status, unless the Registered Name Holder is provided with the reasonable opportunity and ability to unlock the domain name prior to the Transfer Request.
* Domain name registration period time constraints, other than during the first 60 days of initial registration or during the first 60 days after a registrar transfer.
* General payment defaults between Registrar and business partners / affiliates in cases where the Registered Name Holder for the domain in question has paid for the registration.
------
One can file a complaint at
http://www.internic.net/ - click link on right hand side under "Have a Problem with a Registrar?"
ICANN itself likely isn't going to do much about the matter, but puts the incident on record and may, if many others file similar complaints, help motivate the registrar to follow-through.
Most likely with some persistence, and reminding GoDaddy about the 2009 RAA, which they agreed to, will get things moving in the right direction.
Ron