Prioritize strict security invariants in workflow changes

Treat GitHub Actions and approval-flow changes as security-sensitive: preserve manual recovery, trusted-code execution, immutable transitions, and live provenance checks before privileged actions. Never claim workflow or environment guards isolate organization-wide SENTRY_INTERNAL_APP_PRIVATE_KEY or SENTRY_RELEASE_BOT_PRIVATE_KEY. Record their existing exposure as a separate Security-led workstream; it is not a merge blocker unless the current change worsens it.