Remove preview publication approval gate

[Norbert515]

Summary

• remove the manual extension-publication environment approval during the registry preview;
• retain the protected-main deployment policy, source/publication PR split, and required canonical validation;
• document the authenticated-maintainer fallback while the optional publication GitHub App secrets are not configured;
• require an atomic settings and documentation change when reviewer approval is enabled for rollout.

Verification

• Live environment has no required reviewers and still allows protected branches only
• python3 -m unittest discover -s tool/tests -v
• python3 tool/registry.py validate --root . --json
• git diff --check