fix: re-enable environment protection with proper secrets configuration

- Add environment-specific GH_TOKEN to release environment
- Restore environment protection for approval workflow
- Confirmed that environments require their own secrets, not inherited from repository level

Author: zhoukai

.github/workflows/build-and-release.yml

@@ -286,6 +286,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [build, source-archive, create-tag]
     if: always() && needs.create-tag.result == 'success'
+    environment: release
 
     steps:
     - name: Checkout code