fix(release): require protected release-publish environment for npm/PyPI OIDC publishing

[alxxjohn]

Motivation

• The npm and PyPI publish jobs used OIDC (id-token: write) without a GitHub environment constraint, which lets a workflow-dispatchable caller on an unprotected ref impersonate the trusted top-level workflow and publish packages.

Description

• Add environment: release-publish to the publish-npm job in .github/workflows/cd.yml.
• Add environment: release-publish to the publish-pypi job in .github/workflows/cd.yml.
• Update packaging/README.md to require the release-publish environment for npm and PyPI trusted-publisher configuration and to recommend deployment branch protection and required reviewers for that environment.

Testing

• Parsed the modified workflow with ruby -e 'require "yaml"; YAML.parse_file(".github/workflows/cd.yml")' and the YAML parsed successfully.
• Ran git diff --check and basic repository status checks which showed no diff errors.
• actionlint was not available in the environment, so workflow static linting with actionlint was not executed.

---

Codex Task