Replace unavailable environment approvals with layered branch gates
When a repository plan cannot enforce human reviewers on a protected deployment environment, do not treat environment-scoped secrets as an approval gate. Restrict the environment to one exact release branch, protect that branch with an independent approval, last-push approval, st…