chore(governance): configure protected production environment

[seonghobae]

Problem

PR #39 adds a fail-closed audit for the GitHub production environment, but repository code cannot create or prove all organization-level operational controls. Production deployments will remain blocked until the live environment satisfies the audited policy.

Commercial-readiness impact

A buyer or security reviewer needs evidence that production credentials and deployment execution require independent approval, cannot be self-approved, and are restricted to protected refs. The environment API also does not expose whether administrator bypass is disabled, so that control requires separately reviewed evidence.

Acceptance criteria

• Create or update the GitHub production environment for ContextualWisdomLab/noema.
• Configure at least one concrete User or Team required deployment reviewer.
• Enable Prevent self-review.
• Restrict deployment branches/tags to protected branches only.
• Disable custom branch policies for this environment.
• Deselect Allow administrators to bypass configured protection rules.
• Record the environment owner, reviewer ownership, and auditable break-glass procedure.
• Configure environment-scoped CF_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, NOEMA_EXCHANGE_URL, KPI source variables, and rotation owner without copying secrets into repository files.
• Run npm run production:governance with repository read access and retain a PASS report.
• Dispatch noema-production-deploy for an immutable release and retain the 365-day deployment evidence artifact.

Verification

• A deployment request remains waiting until an independent reviewer approves it.
• The initiator cannot approve their own request.
• A non-protected ref cannot deploy.
• A weakened or missing environment rule makes production:governance fail before any Cloudflare credential-bearing step.
• The buyer data room contains the governance report, workflow URL, deployment receipt, and reviewed evidence that administrator bypass is disabled.

Related: #39