production environment secret boundary

Chose the protected production environment over repository- or organization-scoped publishing secrets because its main-only policy and disabled admin bypass gate credential access. Exceptions: SENTRY_INTERNAL_APP_PRIVATE_KEY and SENTRY_RELEASE_BOT_PRIVATE_KEY are organization-wide and this repository cannot isolate them; workflow guards cannot narrow that exposure. Treat it as a separate Security-led risk and block only if the current change worsens it.