[codex] fix release approval handoff

[TheGreenCedar]

Summary

• pass the short-lived approval repository secret explicitly from release.yml
• keep the called evidence job behind the protected release-evidence environment
• forbid approval secrets in PR/package callers
• document deletion of the temporary repository secret after publication

Local proof

• workflow-policy tests 7/7
• structural workflow policy
• actionlint
• retrieval generalization lint
• docs links
• release version sync
• git diff check

No Rust or product runtime code changed. Per release-coordinator direction, merge without waiting for hosted PR checks.

Closes #1141
Refs #1136
Refs #899