ci: gate versioned releases behind the release environment (#58885)

Author: thdxr

.github/workflows/publish.yml

@@ -4,11 +4,8 @@ run-name: "${{ format('release {0}', inputs.bump) }}"
 on:
   push:
     branches:
-      - ci
       - dev
       - beta
-      - fix/npm-native-binary-install
-      - snapshot-*
   workflow_dispatch:
     inputs:
       bump:
@@ -42,6 +39,8 @@ jobs:
   version:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     if: github.repository == 'anomalyco/opencode'
+    # Versioned releases wait for approval in the release environment, which only allows dev.
+    environment: ${{ (inputs.bump || inputs.version) && 'release' || '' }}
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with: