next.js

354b77de - [cd] Gate release bot credentials behind GitHub environments (#100121)

[cd] Gate release bot credentials behind GitHub environments (#100121) Moves access to Next.js bot behind GitHub environments to ensure the bot only runs code that has been reviewed by at least two people with write access. New GitHub environments: - `bot-autonomous` - `bot-approved` ## Testing - Verified all 6 remaining key consumers on canary are covered (`git grep RELEASE_GITHUB_APP_PRIVATE_KEY` only finds the environment-backed mint steps). - After settings land: dispatch canary with `force=false` right after a release (exits early but exercises env + mint), and dispatch stable with `dryRun=true` to watch the `bot-approved` approval gate trigger with no side effects. - The nightly canary is the real soak test for `bot-autonomous`. Backports: #100123 (`releases/lts/active`), #100124 (`releases/lts/maintenance`) --------- Co-authored-by: Claude Code <noreply@anthropic.com>