ci: gate visual regression behind manual approval hold

Mirror e2e's e2e-hold: a `hold` job on the protected `approve_e2e_testing`
environment that build-ios and build-android depend on, so the macOS + emulator
legs only run after a reviewer approves.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.github/workflows/visual-regression.yml

@@ -32,9 +32,21 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Manual approval gate, mirroring e2e's e2e-hold: nothing builds or runs until
+  # a reviewer approves the protected environment. Keeps the expensive macOS +
+  # emulator legs off every push.
+  hold:
+    name: Visual Regression Hold
+    if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
+    environment: approve_e2e_testing
+    runs-on: ubuntu-latest
+    steps:
+      - run: echo "Waiting for manual approval..."
+
   build-ios:
     name: Build iOS
     if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
+    needs: [hold]
     uses: ./.github/workflows/visual-regression-build-ios.yml
 
   run-ios:
@@ -58,6 +70,7 @@ jobs:
   build-android:
     name: Build Android
     if: ${{ github.repository == 'RocketChat/Rocket.Chat.ReactNative' }}
+    needs: [hold]
     uses: ./.github/workflows/visual-regression-build-android.yml
 
   run-android:

tests/owl/README.md

@@ -65,7 +65,7 @@ out over every device leg.
 
 | Workflow | Role |
 | --- | --- |
-| `visual-regression.yml` | Orchestrator. `workflow_dispatch` (with an `update_baseline` toggle) + `pull_request` on owl paths. |
+| `visual-regression.yml` | Orchestrator. `workflow_dispatch` (with an `update_baseline` toggle) + `pull_request` on owl paths. Gated behind a manual approval `hold` job (protected `approve_e2e_testing` environment, like e2e) so nothing builds until a reviewer approves. |
 | `visual-regression-build-ios.yml` | Reusable — builds the Owl iOS `.app` once, uploads it. |
 | `visual-regression-build-android.yml` | Reusable — builds the Owl APK once (debug-signed via the `isOwlBuild` fallback), uploads it. |
 | `visual-regression-run-ios.yml` | Reusable — downloads the app, points owl at the leg's simulator, syncs baselines, compares. |