Replace unavailable environment approvals with layered branch gates

When a repository plan cannot enforce human reviewers on a protected deployment environment, do not treat environment-scoped secrets as an approval gate. Restrict the environment to one exact release branch, protect that branch with an independent approval, last-push approval, strict required status check, linear history, resolved conversations, and no force-push or deletion. Keep mutation jobs fail-closed on uniquely named environment credentials. This preserves strong code and credential boundaries, but it is not equivalent to a human deployment-time approval; document that limitation and upgrade the plan if that control is mandatory.

Applies when: a private repository supports environment secrets and branch policies but not environment reviewers. Keywords: deployment approval environment reviewers branch protection required check secrets