docs: document the release procedure

[sebartyr]

Adds RELEASING.md, following the decision to keep publishing manual — no CI workflow, no PyPI token stored in the repository.

The procedure only existed as knowledge, so this writes it down and orders it so the irreversible step comes last. It states plainly that a PyPI version number can never be reused, even after deletion — only yanked — and gives the recovery path when a release turns out to be wrong.

Points it captures that are easy to get wrong:

• The version lives in two places (pyproject.toml and __init__.py) which are not derived from one another, so a mismatch only shows up after publication.
• Tag the merge commit, so the tag points at reviewed code.
• Verify the wheel actually ships py.typed: the package advertises Typing :: Typed, and without that file type checkers silently ignore every annotation.
• Install the built artifact in a throwaway environment and import it, which catches a broken package that still builds fine.

Every command in the document was run against the 0.2.0 artifacts: uv build, uvx twine check (both distributions PASSED), the py.typed check, and the isolated install-and-import.

Also ships CHANGELOG.md in the sdist, so the release notes travel with the source distribution, and links the document from the README.

Tag v0.2.0 and the GitHub release are already created, with both artifacts attached. The PyPI upload is left to you: it is irreversible and needs your token.