chore: gate release publishing behind environment

[marandaneto]

💡 Motivation and Context

Release workflows should not rely on needs: as the only connection between an approved environment-gated job and the jobs that publish packages, push release tags, or create GitHub releases. A modified workflow could otherwise remove that dependency and run trusted release steps without the intended approval gate.

This PR keeps release side effects behind the protected release environment.

💚 How did you test it?

• Parsed the changed workflow YAML with Python/PyYAML.
• Ran git diff --check.
• Confirmed the branch contains the latest origin/main before opening this draft PR.

📝 Checklist

• I reviewed the submitted code.
• I added tests to verify the changes.
• I updated the docs if needed.
• No breaking change or entry added to the changelog.

If releasing new changes

• Ran pnpm changeset to generate a changeset file