Enable protected release environments for Marketplace actions #5427

🤖 Generated by the Agentic Engineer

Description

The new Marketplace actions need release credentials that are available only to protected default-branch runs. The shared implementation is tracked in devantler-tech/.github#779. Its environment declarations require two provider resource types that the platform has not activated or granted to the GitHub configuration tenant.

Expected behavior

The GitHub configuration tenant can reconcile the reviewed release environments and their main-only branch policies through its existing namespaced GitOps authority. The change does not grant access to other tenants or introduce a secret value.

Acceptance criteria

• Activate the provider's Environment and EnvironmentDeploymentPolicy resource definitions and add only the corresponding resources to the existing namespaced tenant Role.
• Preserve parity between activated resource types and the Role, and pass the existing parity, render, repository and admission checks.
• Deliver the platform prerequisite before the dependent configuration declarations, then observe both resource definitions as established and the tenant's scoped permissions as effective.
• Keep credential custody and the protected release's positive and negative runtime observations on Constrain release authority to protected source .github#779; resource activation alone does not establish those outcomes.

Rough size: Small. Prerequisite for devantler-tech/.github#779 and the Marketplace action publication in devantler-tech/.github#775.