chore: don't require approval on scheduled canary releases

[davidkna-sap]

Context

Closes SAP/ai-sdk-js-backlog#ISSUENUMBER.

This ensure scheduled event do not require approval.

What this PR does and why it is needed

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Context

What this PR does and why it is needed

This PR updates the publish.yml GitHub Actions workflow to allow scheduled canary releases to proceed without requiring manual approval, while still enforcing approval for releases triggered by a GitHub Release event.

Key changes:

• Adds an approval job that conditionally uses either the ensure-main environment (for scheduled runs, no approval gate) or the approve-release environment (for GitHub Release events, requires approval).
• Adds an ensure-main job that only runs on GitHub Release events to verify the release is on the main branch.
• Updates delegate_to_release_job to depend on both approval and ensure-main.
• Updates delegate_to_canary_job to depend on approval, enabling scheduled canary releases to skip the approval gate automatically.

This ensures that nightly scheduled canary builds are fully automated without blocking on a manual approval step, while official releases still require explicit sign-off.

Category: 🔧 Chore

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.29.18

• LLM: anthropic--claude-4.6-sonnet
• Correlation ID: 40b77540-9560-11f1-8479-6f67f1f1dacc
• File Content Strategy: Full file content
• Summary Prompt: Default Prompt
• Output Template: Repository PR Template
• Event Trigger: issue_comment.edited

[davidkna-sap]

I am making this conditional here, because otherwise delegate_to_canary_job will need a more complicated if expression.

[marikaner]

Is there a benefit to adding these additional environments and enforcing them here?
Why don't we just split the release environment into two?

release:

• needs approval, runs on main, registered on npm

canary-release:

• registered on npm

Also:

• The current ensure-main environment only ensures that this runs on a protected branch, not necessarily main.
• I think it would be nice to allow publishing canary versions from a different branch than main, this is helpful if you need to try something out before merging it.

[davidkna-sap]

@marikaner We can only register one environment on npm afaik.

The way this should work now:

• Scheduled release: no approval, needs to run on main/protected branch.
• Regular release: approval, needs to run on main/protected branch.
• Manual canary release: approval, no branch restrictions.