ci: release on demand and gate publishing on approval

CB-593. Until now, every push to main ran release-please, which kept a
release PR open at all times, and merging it published to PyPI through
the release event with no further check. The 1-pager wants publishing to
be a deliberate, manual step.

- release-please.yml now runs on workflow_dispatch, or on a push that
  changes .release-please-manifest.json (a release PR merging), which
  still tags it and creates the GitHub Release. Ordinary pushes no longer
  open or refresh a release PR. The changed-files check works for any
  merge method; matching on the "release: " title wouldn't.
- The publish job runs in the "release" environment, which requires
  William's approval (created 11-04). Manual re-publishes go through the
  same gate.
- No release-as input: release-please-action ignores it in manifest mode.
  To force a version, land a commit with a "Release-As: x.y.z" footer.

stlc treats .github/workflows/* as branch-owned scaffolding, so these
edits survive regeneration and need no re-seal.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: spicysouvlaki

.github/workflows/publish-pypi.yml

@@ -15,6 +15,7 @@ jobs:
     # identical); only production may publish. A stray GitHub Release on the
     # staging repo must never reach PyPI.
     if: github.repository == 'browserbase/sdk-python'
+    environment: release
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/release-please.yml

@@ -3,14 +3,20 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
 
 permissions:
   contents: write
   pull-requests: write
 
 jobs:
   release-please:
-    if: github.repository == 'browserbase/sdk-python'
+    # Release PRs open only when someone runs this workflow. A push runs it only
+    # when a release PR merges (it bumps the manifest), to tag the release.
+    if: >-
+      github.repository == 'browserbase/sdk-python' &&
+      (github.event_name == 'workflow_dispatch' ||
+      contains(toJSON(github.event.commits.*.modified), '.release-please-manifest.json'))
     runs-on: ubuntu-latest
 
     steps: