v6: release pipeline — human-gated publish, trusted publishing, changelog

[Pandys]

• Publish job in a protected GitHub environment (required reviewer approval) — releases are timed by a human who knows the 6-cluster rollout state, never auto-fired by a proto tag
• PyPI trusted publishing (OIDC), no long-lived tokens
• Versioning: v6.0.0 initial; minor per proto sync (additive surface), patch for client fixes, major only for deliberate breaks
• GitHub release notes include the proto diff of the sync
• Docs build/publish hooks into the same workflow (docs issue)
• Deprecation notice on the 5.x line on PyPI