Implement ORP approval workflow.

- Production releases will have a "orp" signature required.
- Pull request on closed releases will be closed automatically with
  an explanatory message.