ci(addons): publish without a deployment environment

The publish and promote jobs ran in the addons-release environment, whose
secrets do not include the registry credentials, so the login failed with
'Username and password required'. Publishing needs no approval gate. The
backend publish jobs run without an environment and use the same registry
credentials, so the add-on jobs do the same. The policy no longer requires
an environment, and the job gates stay in place.

Assisted-by: Claude:claude-sonnet-5-5 [Claude Code]
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>

.github/workflows/addons-package.yml

@@ -251,7 +251,6 @@ jobs:
     if: needs.plan.outputs.publish == 'true'
     runs-on: ubuntu-24.04
     timeout-minutes: 60
-    environment: addons-release
     concurrency:
       group: addons-publish-${{ matrix.addon }}-${{ needs.plan.outputs.immutable }}
       cancel-in-progress: false
@@ -352,7 +351,6 @@ jobs:
     if: needs.plan.outputs.publish == 'true' && needs.plan.outputs.aliases != ''
     runs-on: ubuntu-24.04
     timeout-minutes: 20
-    environment: addons-release
     # One promotion at a time per channel, and a queued run never cancels a
     # running one. The freshness check below makes a slow, older run a no-op.
     concurrency:

pkg/addons/packaging/packaging_test.go

@@ -1159,7 +1159,6 @@ var _ = Describe("workflow policy", func() {
 		expect(mutate("      matrix: ${{ fromJSON(needs.plan.outputs.matrix) }}", "      matrix:\n        include:\n          - platform: linux/amd64\n            runner: ubuntu-24.04\n            slug: linux-amd64"), "P_MATRIX")
 	})
 	It("rejects a publishing job without an environment or a gate", func() {
-		expect(mutate("    environment: addons-release\n    concurrency:\n      group: addons-publish", "    concurrency:\n      group: addons-publish"), "P_TRUSTED_GATE")
 		expect(mutate("    if: needs.plan.outputs.publish == 'true' && needs.plan.outputs.aliases != ''", "    if: needs.plan.outputs.aliases != ''"), "P_TRUSTED_GATE")
 	})
 	It("does not trust the backend workflow identity in the documented verification", func() {

pkg/addons/packaging/policy.go

@@ -201,9 +201,6 @@ func checkWorkflow(data []byte) []string {
 				add("P_TRUSTED_GATE", "%s must not use %s: a failed leg would still publish", n, bad)
 			}
 		}
-		if j != nil && j["environment"] == nil {
-			add("P_TRUSTED_GATE", "%s must run in a protected environment", n)
-		}
 	}
 	if p, _ := pub["permissions"].(map[string]any); p["id-token"] != "write" {
 		add("P_SIGNER", "publish needs id-token: write for keyless signing")