Protect release credentials with environment scope

[sansari]

Summary

• bind the official release job to the release GitHub environment
• generate a fresh temporary-keychain password on each workflow run
• document environment-scoped credentials and remove the obsolete keychain-password secret

Validation

• parsed .github/workflows/release.yml successfully
• passed scripts/test-release-dmg.sh
• verified all expected environment secret names and the APPLE_TEAM_ID variable are configured
• verified the workflow and docs no longer reference APPLE_KEYCHAIN_PASSWORD

Environment setup

Before creating a release tag, restrict the release environment to protected v* tags and optionally require maintainer approval.

Review note

A fresh automated security reviewer was requested but unavailable due provider quota; public CI and maintainer review remain required before merge.