ci: harden the production environment and document publish recovery

[Bre77]

Intent

• Harden the production environment that publish.yml's release and publish-pypi jobs already gate on, per the CI/release hardening follow-up to ci: gate publish on the full CI suite for the exact publish SHA #23.
  • Configured a required reviewer and a main-only deployment branch policy directly on the production GitHub environment via the API (gh api repos/Teslemetry/tesla-protocol/environments/production) - this is GitHub-side config, not something publish.yml itself controls, so there's no workflow diff for it.
  • Verified the approval ordering is already correct: both jobs declare needs: ci/needs: [ci, release], so the environment's reviewer prompt can only fire after the reusable ci.yml gate from ci: gate publish on the full CI suite for the exact publish SHA #23 has passed for that exact SHA. GitHub also only prompts once per workflow run even though two jobs reference production, so approving release covers publish-pypi too.
  • Documented recovery/idempotency for an interrupted publish in the README: re-running a failed job is always the recovery path. changeset publish checks the npm registry before publishing, so re-running release is a no-op for versions already live. pypa/gh-action-pypi-publish already runs with skip-existing: true, so re-running publish-pypi skips versions already uploaded instead of erroring.
  • No new release mechanism - Changesets, OIDC trusted publishing, and the existing production environment are unchanged.