Setting up releases from CI

Summary

End-to-end CI setup: one API key with write:releases and write:testing, kept as a GitHub environment secret limited to main; the production approval on its own reviewers-only environment (production-approval) so the release gate runs after the approval, right before the deploy (a job waits for approval when it starts, so a gate before it answers stale); JSON bodies sent base64-encoded in a payloadBase64 envelope; job order (report, upload, approve, gate, deploy); copy-paste reusable GitHub Actions workflows for the gate and deployment reports (including status waiting with awaiting/note); a hold-off-first rollout; the gate response; GitLab, Jenkins, shell and CLI equivalents.