[codex] Add release remote approval gate

[Atomics-hub]

Summary

• Add AGENTK_RELEASE_REMOTE_APPROVED as an explicit signal for approved public remotes in strict release gates.
• Keep configured remotes as warnings until that approval signal is set.
• Update release docs and tests so strict release-audit can pass after maintainer approval without weakening pre-approval hygiene.

Why

After maintainer release approval, strict release-audit was still blocked by the configured Git remote warning. This makes that approval explicit and auditable instead of leaving strict mode permanently blocked on an approved public remote.

Verification

• cargo fmt --check
• cargo test git_remote_warning_requires_explicit_release_approval -- --nocapture
• cargo test
• cargo clippy --all-targets --all-features -- -D warnings
• cargo run --locked -- release-audit
• AGENTK_REQUIRE_SIGNING_KEY=1 AGENTK_RELEASE_REMOTE_APPROVED=1 AGENTK_SIGNING_KEY_FILE=../agentk-release-signing-key cargo run --locked -- release-audit --strict
• cargo run --locked -- verify-signatures .agentk/runs/latest.jsonl --trusted-public-key <release-public-key>