…t, and remove dead workflows

Replace JSON-secret allowlists and repo-admin checks with GitHub Environment protection rules across all deployment and publishing workflows. Add missing actor gates to three prod CDN deploy workflows that were previously open to any write-access collaborator. Scope test secrets to the step that needs them and clean up dead workflows, scripts, and the check-user-permission action.

Authorization changes:
- publish.yaml: replace Check User Permission, Admin Permission Check, and Allowed Actors steps with `environment: npm-publish | npm-publish-major` dynamic expression; drop SDK_PUBLISH_MAJOR_VERSION_ACTORS from job env
- build-game-bridge.yaml: replace Check SDK Team Membership with `environment: game-bridge-publish`; replace TS_IMMUTABLE_SDK_GITHUB_TOKEN secret with the github-token OIDC action in create-unity-pr and create-unreal-pr (id-token: write, scoped installation token for checkout and gh pr create)
- deploy-audience-cdn.yaml, deploy-pixel-cdn.yaml, passport-sdk-sample-app-deployment.yaml: add missing environment gates (cdn-deploy-audience, cdn-deploy-pixel, cdn-deploy-passport)
- delete .github/actions/check-user-permission — sole caller removed

github-token action (new):
- TypeScript action backed by the Immutable Token Service
- inputs: repositories (newline-separated owner/repo), permissions (key: value)
- output: scoped installation token; caller must set id-token: write

notify-slack-publish-status action:
- rewrite in TypeScript with Rollup bundler (ESM output, node24, @actions/core@3)
- add pnpm workspace isolation, eslint, prettier, tsconfig
- add explicit `webhook` input; move secrets to step-level

Secret scoping:
- pr.yaml func-tests: move 8 test secrets and 14 config vars from job env to step env on the Run functional tests step; NX_CLOUD_ACCESS_TOKEN stays at job level
- deploy-audience-cdn.yaml, deploy-pixel-cdn.yaml: inline AWS_REGION directly into configure-aws-credentials with: block, remove from job env

Dead code removed:
- publish-docs.yaml, publish-example-tutorials.yaml workflows
- .github/scripts/{check-docs-deployed,check-docs-version,process-tutorials,push-docs,update-docs-link}.sh
- notify-slack-publish-status/index.js (replaced by src/index.ts + dist/)

Other:
- pixel-bundle-size.yaml: fix contents:read accidentally placed inside env: block
- add dependabot.yml for GitHub Actions ecosystem
- add sticky-comment composite action
- add flows.md documenting environment gates, access control model, and migration rationale with Mermaid diagrams