ci: protect release and lifecycle workflows

[abrichr]

What changed

• Create release tags only after a reviewed version, changelog entry, and lock state are present on the exact protected main commit.
• Give the release App one job: push the annotated release tag. It can't push a commit or branch.
• Publish the exact App-created tag to PyPI through OIDC. Exact-tag reruns are safe after a partial release.
• Add the App-only workflow that prepares Production lifecycle evidence for review.
• Reject the lifecycle App from the general evaluation workflows and keep their runs event-specific and non-cancelling.
• Remove the legacy documentation dispatch token and sender.

Why this is a draft

This PR must not merge until the openadapt-docs App dispatcher is installed and verified. The PR removes .github/workflows/notify-docs.yml and DOCS_DISPATCH_TOKEN. Merging it before the replacement exists would stop the current documentation sync.

The release and lifecycle paths also need their reviewed GitHub Apps, repository settings, and protected environments before anyone uses them.

Checks

• 275 focused tests
• Ruff
• actionlint
• YAML parse
• recovery policy contracts
• source boundary check
• fresh wheel and source archive scans
• git diff --check