ci(sdk): require approved npm publishing environment

[eloi010]

Summary

• require the protected npm-publish environment for real SDK releases while keeping dry-run preflight checks approval-free
• default workflow permissions to none and grant each job only its required scopes
• validate a full commit SHA on origin/main and use the verified commit for checkout, tags, and GitHub Releases
• preserve existing package and legacy publishing behavior

Validation

• actionlint .github/workflows/sdk-publish.yml
• git diff --check
• verified all publish, tag, and GitHub Release steps remain disabled during dry runs
• verified external actions remain pinned to commit SHAs

The workflow was not dispatched and no package was published.

[Copilot]

Pull request overview

Hardens SDK publishing with protected-environment approval, least-privilege permissions, and verified release commits.

Changes:

• Gates real npm releases behind npm-publish.
• Verifies and consistently uses a commit from origin/main.
• Scopes permissions per job while keeping dry runs approval-free.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.