fix(ci): require approval before publishing Python SDK releases

[aidandaly24]

Summary

• Route the release approval checkpoint through the existing protected manual-approval environment instead of pypi-approval.
• Keep the pypi publishing environment and OIDC trusted publishing configuration unchanged.
• This is a repository-only change; no GitHub environment settings are modified.

Validation

• git diff --check origin/main...HEAD passed.
• Parsed the workflow YAML and verified that only the approval environment changes, the publish job still depends on release approval, and the PyPI environment remains unchanged.
• Confirmed that the existing manual-approval environment has required reviewers.
• No release workflow was triggered; SDK tests were not run for this workflow-only change.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@b2a094d). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #692   +/-   ##
=======================================
  Coverage        ?   89.54%           
=======================================
  Files           ?      124           
  Lines           ?    10727           
  Branches        ?     1676           
=======================================
  Hits            ?     9605           
  Misses          ?      734           
  Partials        ?      388           

Flag	Coverage Δ
unittests	89.54% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.