chore: require approval for release-sensitive workflows

[nikuscs]

Summary

• add a fork-origin guard to PR-triggered CI so fork PR jobs do not run
• disable persisted checkout credentials in CI checkout
• bind tag creation and failure cleanup jobs to the protected release environment
• keep Apple notarization/signing and Sparkle signing under the existing protected release environment

Validation

• parsed workflow YAML locally
• ran git diff --check
• verified release environment has required reviewers configured

Notes

• This PR intentionally does not restrict allowed_actions; that remains deferred to avoid broad workflow churn.