docs(release): make tag-push the canonical release path

[dean0x]

Summary

Documents the tag-push release flow as canonical and flags the
workflow_dispatch -f version= path as currently broken. Surfaced during the
v0.3.0 release, where the dispatch path failed GH006 (the prepare job can't push
the release commit to protected main), left an orphaned tag, and published
nothing — v0.3.0 ultimately shipped via tag-push.

Changes

• CLAUDE.md — ## Release now leads with bump → PR → tag-push; dispatch path marked broken (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127).
• RELEASING.md — "Tag-push (current working path)" section; old "Automated (recommended)" → "currently BLOCKED (release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127)".
• .release/RELEASE-FLOW.md — Publish section: tag-push trigger + flow (prepare skipped); dispatch flagged blocked.

Docs only — no code or workflow changes.

Related

• Refs release: workflow_dispatch path fails GH006 on protected main (prepare can't push) #127 (fix the workflow_dispatch path: PAT/App bypass or prepare-opens-PR)
• ci(wasm): pin wasm build toolchain for deterministic size; re-tighten size budget #128 (pin WASM toolchain + size budget), test: flaky cli_watch.rs::watch_ctrl_c_prints_stopped_watching (timing) #129 (flaky cli_watch test) — other infra follow-ups from the same release.