ci: scope publish secrets behind a deployment environment (zizmor secrets-outside-env)

The Audit runs `zizmor .github --min-severity medium`, which failed on four
`secrets-outside-env` MEDIUM findings — the new RubyGems/Composer publish jobs
referenced `secrets.*` without a dedicated GitHub environment (release.yml
gem-publish; release-ecosystems.yml rubygems-cli + packagist-cli). Add a job
`environment:` (`rubygems` / `packagist`) to each, which scopes the secret (and
lets a maintainer later gate publishing with required reviewers; the env is
auto-created with no protection until configured). Verified with the org's exact
invocation (zizmor 1.23.1, `.github`, --min-severity medium): the four findings
are gone; the only remaining medium is the pre-existing artipacked on
release.yml:182 (not mine, suppressed in the org's --gh-token run).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mikolalysenko

.github/workflows/release-ecosystems.yml

@@ -55,6 +55,10 @@ jobs:
   rubygems-cli:
     needs: resolve-version
     runs-on: ubuntu-latest
+    # Scope the publish secret to a deployment environment (zizmor
+    # secrets-outside-env); also lets a maintainer gate publishing with required
+    # reviewers. Auto-created with no protection rules until configured.
+    environment: rubygems
     permissions:
       contents: read
     steps:
@@ -106,6 +110,9 @@ jobs:
   packagist-cli:
     needs: resolve-version
     runs-on: ubuntu-latest
+    # Scope the Packagist secrets to a deployment environment (zizmor
+    # secrets-outside-env); auto-created with no protection until configured.
+    environment: packagist
     permissions:
       contents: read
     steps:

.github/workflows/release.yml

@@ -471,6 +471,9 @@ jobs:
     if: ${{ !inputs.dry-run }}
     runs-on: ubuntu-latest
     continue-on-error: true
+    # Scope the publish secret to a deployment environment (zizmor
+    # secrets-outside-env); auto-created with no protection until configured.
+    environment: rubygems
     permissions:
       contents: read
     steps: