Add a deploy-time guard for effective environment reviewer protection

[willwashburn]

Context

Follow-up to #42. Keep this out of #42 because it changes deployment behavior and can block production on an API read.

GitHub environment configuration can be present while enforcement is void:

• A workflow may name an environment that does not exist.
• Protection rules can remain stored and visible after a public repository becomes private on a plan where those rules are ignored.

A configuration-only read-back can therefore pass without proving that the deploy gate is enforced.

Proposed control

Add a separate deploy workflow guard that checks the intended production environment before deployment and fails unless the required-reviewer protection is effective for the repository's current visibility and plan.

Acceptance criteria

• References ci: gate production deploys with a protected environment #42 but is implemented and reviewed separately.
• Detects a missing/phantom production environment.
• Detects visible-but-inapplicable protection after a visibility or plan change.
• Distinguishes an absent rule from API authentication, authorization, rate-limit, and transport failures.
• Documents fail-open versus fail-closed behavior explicitly; default recommendation must account for the risk of halting production on an unrelated API failure.
• Uses least-privilege permissions and does not expose environment secrets.
• Includes tests/fixtures for both silent-void cases and token-scope/API-failure behavior.
• Provides an operational recovery path when the guard blocks deployment.