fix: add GitHub Environment protection to publish/deploy workflows

Add `environment:` declarations to all publish and deploy jobs so that
GitHub Environment protection rules (required reviewers, deployment
branches, wait timers) can gate package publishing and deploys.

- prerelease.yml publish → environment: npm
- publish-commit.yml build → environment: npm
- publish-release.yml publish → environment: npm
- stable-release.yml create-release-pr → environment: npm
- showcase_deploy.yml verify → environment: railway

Author: jpr5

.github/workflows/prerelease.yml

@@ -86,6 +86,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    environment: npm
     permissions:
       contents: read
     steps:

.github/workflows/publish-commit.yml

@@ -23,6 +23,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    environment: npm
     permissions:
       contents: read
       # pkg-pr-new posts snapshot comments on the PR using the workflow token

.github/workflows/publish-release.yml

@@ -80,6 +80,7 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 20
+    environment: npm
     permissions:
       contents: write
     steps:

.github/workflows/showcase_deploy.yml

@@ -160,6 +160,7 @@ jobs:
     if: needs.resolve-matrix.outputs.has_services == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    environment: railway
     permissions:
       contents: read
       actions: read

.github/workflows/stable-release.yml

@@ -40,6 +40,7 @@ jobs:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 15
+    environment: npm
     steps:
       - name: Check for existing release PR
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7