fix: separate beta and production release environments

[abueide]

Summary

Split release workflow to use different GitHub environments for beta vs production releases.

Problem

Currently, all releases (beta and production) use the same "Publish" environment which requires manual approval from reviewers. This prevents team members from self-publishing beta releases for customer testing.

Solution

Created two separate environments with different protection rules:

Publish-Beta (New)

• ✅ No reviewer approval required
• ✅ Restricted to * branches (any branch from Segment org members)
• ✅ Team members can self-publish betas for testing
• ❌ External contributors cannot publish

Publish (Existing)

• ✅ Requires reviewer approval (secondary check)
• ✅ Used for production releases only
• ✅ Maintains safety for stable releases

Changes

• Split release job into three separate jobs:
  • release-dryrun - No environment (no publishing)
  • release-beta - Uses Publish-Beta environment
  • release-production - Uses Publish environment
• Each job runs conditionally based on inputs.type

Workflow

Beta releases (self-service for team):

1. Push feature/fix branch
2. Actions → Release → Beta
3. Publishes immediately (no approval needed)

Production releases (requires approval):

1. Ensure code is on master
2. Actions → Release → Production
3. Waits for reviewer approval
4. Publishes after approval

Security

• ✅ Only Segment org members can trigger workflows
• ✅ Both environments restricted to org members
• ✅ Production still requires secondary approval
• ✅ NPM provenance enabled for all releases

---

🤖 Generated with Claude Code