ci: require approval of the npm-production environment before npm publish

[nTEG-dev]

What

Adds environment: npm-production to the publish job in .github/workflows/ci.yml. Nothing else changes.

Why

v1.11.2 published to npm within minutes of the tag push, with no human approval. The publish job only needs build, the two hook jobs and the venue gate, then runs npm publish; the npm-production approval step that was expected did not exist anywhere in the workflow or in the repo's environments.

With this change a v* tag still runs build, hooks and the venue gate, then the publish job waits until a required reviewer approves the npm-production environment.

Before this takes effect (Chris, in GitHub)

The environment has to exist with a required reviewer, otherwise GitHub creates it with no protection and publishes without waiting.

1. Repo → Settings → Environments → New environment, name it exactly npm-production, Configure environment.
2. Under Deployment protection rules tick Required reviewers, search for and add Chris (add a second person if there is one, so a release is never stuck on one account), Save protection rules.
3. Optional: tick Prevent self-review only if someone other than the person who pushed the tag should approve (leave it off for a solo release).
4. Under Deployment branches and tags → Selected branches and tags → Add deployment branch or tag rule → Ref type Tag, pattern v*, so only release tags can reach the environment.
5. Recommended: move the NPM_TOKEN secret from Settings → Secrets and variables → Actions → Repository secrets into this environment's secrets (same name), then delete the repository-level copy. A repository secret is readable by any workflow; an environment secret is released only after the approval.

Test plan

• Environment created as above.
• Next v* tag: the run reaches publish and shows "Waiting for review"; nothing is on npm until Chris approves.

Not merged. 🤖 Generated with Claude Code

[nTEG-dev]

Closing without merging: Chris decided against a GitHub approval step. Releases go out when he tells the release agent to merge and tag.