feat: require manual approval before npm publish + drop release-as pin

The publish-npm job now targets the npm-publish environment, whose
required-reviewer rule pauses the job for maintainer approval in the
Actions UI before anything reaches the registry. Also removes the
release-as 0.1.0 pin from release-please-config.json now that v0.1.0
has shipped — leaving it would stamp every future release 0.1.0.

.github/workflows/release-artifacts.yml

@@ -112,6 +112,12 @@ jobs:
     needs: package
     if: ${{ startsWith(github.ref, 'refs/tags/v') }}
     runs-on: ubuntu-latest
+    # Manual approval gate: this environment carries a required-reviewer rule
+    # (Settings -> Environments -> npm-publish), so the job pauses until a
+    # maintainer approves it in the Actions UI before anything reaches npm.
+    environment:
+      name: npm-publish
+      url: https://www.npmjs.com/package/@gitlawb/zero
     permissions:
       contents: read
       id-token: write # OIDC token exchange for npm trusted publishing + provenance

release-please-config.json

@@ -5,8 +5,7 @@
   "bootstrap-sha": "02f0c0929bec65f5fc41bdcab3eb518d2b0b329a",
   "packages": {
     ".": {
-      "package-name": "@gitlawb/zero",
-      "release-as": "0.1.0"
+      "package-name": "@gitlawb/zero"
     }
   }
 }