[no-issue] docs: RELEASE.md PR-based release flow (main protected)

[vinicq]

Summary

main is now a protected branch (issue #142): direct pushes are rejected, changes land via PR with green test CI, and commits on main must be signed. Update RELEASE.md so the release process matches — prepare on a branch, merge via PR, then tag the merged commit.

Changes

• Rewrite the "Publishing a version" section into two phases: prepare-on-branch, then merge-and-publish.
• Tag/gh release create happen after merge, on the merged main commit (squash makes a new SHA), and are not blocked by branch protection (they act on refs/tags/*).
• Fix a stale lockstep note: the version must be bumped in four places including CITATION.cff (the test_version_lockstep test already enforces this; the doc omitted it).

Test plan

• Docs-only change; no scanner logic touched. CI (test (3.8/3.11/3.13)) runs on this PR and must pass.

Related issues

Refs #142.