fix(release): unify target identity contract

[AprilNEA]

Summary

• prove publisher-resolved LinkCode IDs flow verbatim to Desktop, iOS, and Android consumers
• require every brand-matrix row to use the single protected release Environment
• remove per-brand Environment inspection and align release/environment documentation

Stack

This PR is intentionally based on #436 (xuan/code-561) and must land only after that reviewed integration reaches master.

Validation

• pnpm install --frozen-lockfile
• pnpm check:ci
• pnpm test (2,861 passed; 5 skipped)
• focused workflow/identity tests (34 passed)
• release workflow YAML parse
• focused Biome check and git diff --check

[linear-code]

CODE-561

[pullfrog]

Your Claude subscription has hit its usage limit. It resets at Aug 15, 9pm (UTC). Re-trigger Pullfrog after the reset, or add an ANTHROPIC_API_KEY repo secret — Pullfrog routes around an exhausted subscription automatically when one is present.

Add repo secret → · Model settings → · Setup docs → · Ask in Discord →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using Claude Opus ｜ 𝕏}