fix: require human approval before release publication

[bokelley]

Summary

• require a human approval on the final release PR head before committed protocol artifacts can be published
• leave generated documentation snapshot PRs open for human review instead of enabling auto-merge
• cover both safeguards in the release workflow regression test

Verification

• npm run test:release-workflow
• actionlint .github/workflows/release.yml .github/workflows/release-docs.yml (existing ShellCheck warnings only)
• repository pre-commit suite

[aao-secretariat]

Ladon verdict: Escalate to human review

Escalate — gated paths touched without an approving review.

This PR modifies .github/workflows/release.yml and .github/workflows/release-docs.yml, both of which match the hard approval gate (.github/workflows/**). gated_paths: true and review_decision: REVIEW_REQUIRED (not APPROVED), so decision-table row 2 fires: escalate.

The change itself looks clean — the reviewer found no blocking or medium findings. It adds a fail-closed human-approval gate to release.yml (verifies a non-Bot APPROVED review on the final head SHA before publishing artifacts), removes docs-snapshot auto-merge from release-docs.yml, ships tests pinning the load-bearing predicates, and carries a matching patch changeset with no wire change. There is nothing actionable to fix; the escalation is purely the deterministic gated-paths requirement.

Escalation reasons

• .github/workflows/release.yml and .github/workflows/release-docs.yml are under the .github/workflows/** hard approval gate; review_decision is REVIEW_REQUIRED. Human/CODEOWNERS approval required before merge.

Why human review

• Modifies gated workflow files .github/workflows/release.yml and .github/workflows/release-docs.yml (match .github/workflows/**); review_decision is REVIEW_REQUIRED, so human/CODEOWNERS approval is required.
• This PR touches a path under a hard, non-overridable approval gate (.github/workflows/release-docs.yml (modified) matches .github/workflows/**; .github/workflows/release.yml (modified) matches .github/workflows/**) and the current GitHub review decision is 'REVIEW_REQUIRED', not APPROVED. This is a hard gate enforced in code — Ladon cannot auto-approve until a human/CODEOWNERS approval is recorded, regardless of how clean the diff is.