bug48: drop the approving-review environment gate upstream

Upstream committers have more freedom handling PRs, so the pull_request_review
trigger, the privileged-pr-build environment gate, and the associated
head-SHA / persist-credentials / base-ref conditionals are not needed here.
Remove them, keeping the plain push/workflow_dispatch build.

The dorny/paths-filter correctness fix (v4.0.3 + some-with-excludes + a
positive '**' rule) is retained: it fixes a pre-existing bug where docs-only
changes were misclassified as code changes on the push path too.

The downstream (SAP) branch keeps the environment-based approval approach via
a subsequent 'merge -s ours'.

Assisted-By: Claude Opus 4.8

.github/workflows/release.yml

@@ -7,13 +7,6 @@ on:
       - '**/*.md'
       - 'README.md'
       - 'docs/**'
-  # Run for pull requests only once an approving review has been submitted.
-  # The build for a PR (which may originate from an untrusted fork) therefore
-  # never executes before a maintainer has vetted the exact code. Secrets are
-  # released to the PR build via the "privileged-pr-build" environment gate
-  # (see the "environment" key on the build job below).
-  pull_request_review:
-    types: [submitted]
   workflow_dispatch:
     inputs:
       skip_tests:
@@ -32,34 +25,15 @@ on:
 jobs:
   # The "changes" job will cause the "build" job to get skipped for trivial changes
   changes:
-    # pull-requests: read lets dorny/paths-filter diff via the REST API on the
-    # PR path; the empty default would make it treat everything as changed.
-    permissions:
-      pull-requests: read
-    # Only run for push, manual dispatch, or a PR review that is an approval.
-    # A non-approving review (comment / changes-requested) must not trigger a build.
-    if: ${{ github.event_name != 'pull_request_review' || github.event.review.state == 'approved' }}
+    permissions: {}
     runs-on: ubuntu-latest
     outputs:
       should_run: ${{ steps.filter.outputs.code }}
     steps:
       - uses: actions/checkout@v4
-        with:
-          # On an approving review, evaluate the filter against the reviewed PR
-          # head commit rather than the base branch. fetch-depth: 0 gives the
-          # filter the history it needs to find the merge-base; without it the
-          # shallow clone has no common ancestor and every file counts as added.
-          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || github.sha }}
-          fetch-depth: ${{ github.event_name == 'pull_request_review' && '0' || '1' }}
-          persist-credentials: false
       - id: filter
         uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
-          # pull_request_review is not a pull_request event, so the action does
-          # not auto-detect the PR base. Diff the PR head against the PR base
-          # explicitly so a docs-only PR is correctly seen as no code change.
-          base: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.base.sha || '' }}
-          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || '' }}
           # Under the default 'some' quantifier a negated rule still counts as a
           # match (picomatch treats '!README.md' as "anything but README.md"),
           # so a changed README.md would set code=true. 'some-with-excludes'
@@ -79,17 +53,6 @@ jobs:
   build:
     needs: changes
     if: ${{ needs.changes.outputs.should_run == 'true' || github.event_name == 'workflow_dispatch' }}
-    # For a PR review-triggered run, reference the "privileged-pr-build"
-    # environment so its protection rules (a required-reviewer team) must pass
-    # before the job is sent to a runner and before any secrets are released.
-    # For push / workflow_dispatch the name evaluates to an empty string, which
-    # GitHub treats as "no environment" — those runs are NOT gated and use the
-    # repository-level secrets exactly as before. The environment deliberately
-    # holds no secrets of its own: because same-named secrets resolve
-    # environment > repository, leaving it empty means the repository-level
-    # values are used, so secret rotation stays in a single place.
-    environment:
-      name: ${{ github.event_name == 'pull_request_review' && 'privileged-pr-build' || '' }}
     permissions:
       contents: write
       checks: write
@@ -139,13 +102,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: '500'
-          # On an approving review, build the reviewed PR head commit (which may
-          # come from an untrusted fork) rather than the base branch, and do not
-          # leave the GITHUB_TOKEN in .git/config where that PR code could read
-          # it. For push / workflow_dispatch these evaluate to the previous
-          # defaults, so existing runs are unchanged.
-          ref: ${{ github.event_name == 'pull_request_review' && github.event.pull_request.head.sha || github.sha }}
-          persist-credentials: ${{ github.event_name != 'pull_request_review' }}
       - name: Install JDK 8
         uses: actions/setup-java@v4
         with:
@@ -295,8 +251,6 @@ jobs:
             echo "Build passed."
           elif [[ "${{ needs.build.result }}" == "skipped" && "${{ needs.changes.outputs.should_run }}" == "false" ]]; then
             echo "No relevant changes — skipping is OK."
-          elif [[ "${{ needs.changes.result }}" == "skipped" ]]; then
-            echo "Pipeline did not apply to this event (e.g. a non-approving review) — nothing to gate."
           else
             echo "Build failed or was cancelled."
             exit 1