[Troublor]

Summary

• Use the single review-gated release environment for tagging, GitHub Release creation, and release artifact uploads; use snapshot outside the human review gate for snapshots.
• Rename release-app credentials to organization-level MEGA_GUTENBERG_CLIENT_ID and MEGA_GUTENBERG_PK, document consumer access to the organization secret, and preserve environment-free branch/PR jobs.
• Update L5, the exact MEGA_GUTENBERG_ detector, generated dependency-token steps, fixtures, tests, and documentation. Preserve action names, filenames, third-party SHA pins, and all @main references.

Test plan

• Exit 1 as expected (no matches): old environment declarations/prose and old credential-name greps.
• Exit 0: parse every workflow template with PyYAML; python3 .github/scripts/action_docs.py --check; python3 .github/scripts/app_token_lint.py --repo my-repo workflow-templates/; git diff --check.
• Exit 0: unittest discovery in .github/scripts (86 tests), .github/actions/release-tools (84 tests), and .github/actions/claude-pr-review (113 tests; one existing skip).
• Local limitation: python3 .github/actions/git-auth/test_git_auth.py exits 1 at cargo generate-lockfile; reproduced unchanged on main at d2a90ab. No git-auth files changed.
• The Actions workflow on this PR exercises the full shell integration suite.

Rollout

No repository settings, environments, secrets, or protections are changed here. Consumer repositories must inherit the organization variable/secret and use release / snapshot as appropriate.