Migrate repository secrets to protected environment secrets

.github/repository-settings.md

@@ -4,16 +4,24 @@ This document describes any changes that have been made to the
 settings in this repository outside the settings tracked in the
 private admin repo.
 
-## Secrets and variables > Actions
 
-### Repository secrets
+## Environments
+
+### `protected` environment
+
+Deployment branches: `main`, `release/*`
 
+Secrets:
+
+- `COPILOT_GITHUB_TOKEN` - owned by [@jack-berg](https://github.com/jack-berg)
 - `GPG_PASSWORD` - stored in OpenTelemetry-Java 1Password
 - `GPG_PRIVATE_KEY` - stored in OpenTelemetry-Java 1Password
 - `SONATYPE_GUIDE_PAT` - owned by [@jack-berg](https://github.com/jack-berg)
 - `SONATYPE_KEY` - owned by [@jack-berg](https://github.com/jack-berg)
 - `SONATYPE_USER` - owned by [@jack-berg](https://github.com/jack-berg)
 
+## Secrets and variables > Actions
+
 ### Organization secrets
 
 - `CODECOV_TOKEN`

.github/workflows/build-daily.yml

@@ -14,6 +14,7 @@ jobs:
     uses: ./.github/workflows/reusable-link-check.yml
 
   publish-snapshots:
+    environment: protected
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/release.yml

@@ -7,6 +7,7 @@ permissions:
 
 jobs:
   release:
+    environment: protected
     permissions:
       contents: write # for creating the release
     runs-on: ubuntu-24.04

.github/workflows/sonatype-guide-dependency-audit-daily.yml

@@ -12,6 +12,7 @@ permissions:
 
 jobs:
   analyze:
+    environment: protected
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2