ci: support solo-maintainer release approval

[AlexMarinescu]

Summary

Allow the sole maintainer to approve release runs in the protected environment without a second account.

Changes

• Require the configured maintainer login and immutable account ID for dispatches, reruns, candidate validation runs and the environment reviewer.
• Allow self-review while retaining disabled administrator bypass and protected-branch restrictions.
• Preserve manual dispatch, explicit confirmation, the release-enable switch, final-master/tag binding, successful CI, artifact provenance, SHA-256 checks and overwrite protection.
• Document the environment configuration and add negative tests that reject unauthorized publication before network requests or mutations.

After review, configure gem-release-review with AlexMarinescu as its sole required reviewer, turn off Prevent self-review, keep administrator bypass disabled, and restrict deployments to protected branches. Repository settings have not been changed. Self-approval protects against accidental publication and other identities; it does not provide independent review or protection against compromise of the maintainer account.

Testing

• Full suite: 4,071 passed, zero failures, expected failures or skips.
• Targeted release safeguards: 95 passed.
• Workflow policy checker and Actionlint 1.7.12 passed.
• Documentation checks: 268 public API declarations and 43 executable examples passed.
• Runtime mathematics, packaging metadata and reference assertions unchanged.

No tags, releases or package uploads were created. PyPI publishing remains disabled.

Assisted by OpenAI Codex.