Verify environment reviewers during release setup

[samuel-williams-shopify]

GitHub can accept an environment update while silently dropping Secret reviewer teams. Release setup previously reported success even though the requested publishing approval was not configured.

Plan and apply now reject Secret teams before changing settings, with instructions to make the team Visible. After an environment update, apply reads the settings back and verifies reviewer types/IDs and the preserved protections. Reviewer order and duplicate configured identities do not cause unnecessary updates. A mismatch stops setup and directs the administrator to inspect the environment and rerun plan.

Includes regression tests for dropped or unexpected reviewers, a removed reviewer rule, changed protections, and failed verification reads, plus updated setup guidance and an Unreleased note.

Validation:

• 159 tests / 567 assertions passed using standard Covered/Sus integration; 530/530 library lines covered.
• RuboCop passed; documentation coverage is 32/32 definitions.
• Read-only setup plan against this repository confirms the existing Managers configuration matches.
• Regenerated distributed guidance with bundle exec ruby -rfileutils -S bake utopia:project:agent:context:update.