Add a release process note

[gyli]

Nothing wrote down how a release is cut. The steps lived in release.sh's closing echo, a comment at the top of publish.yml, and nowhere else. That is enough to follow once and not enough to follow again a year later, which is roughly the gap between the last two releases.

RELEASING.md at the repository root covers:

• One-time setup: the PyPI trusted-publishing configuration and the pypi environment the publish job declares. Without both, the workflow runs and fails at the upload step.
• Before releasing: what ./release.sh covers, plus the two checks it does not.
• Releasing: version, changelog, tag, GitHub release, watching the run.
• After: downloading from PyPI to confirm the upload rather than assuming it.
• Notes: the handful of things that are easy to learn the hard way.

Two things it records deliberately

The suite cannot catch a packaging mistake. It imports the working tree, so a missing file or a wrong dependency is invisible to it. The note gives a loop that installs each built artifact into a throwaway venv and draws a chart, in both install modes — a plain install must draw rectangles and refuse icons= with a message naming the extra, an [icons] install must draw icons. That combination is only observable from a clean environment.

A version can never be replaced on PyPI. A file uploaded under a version number is permanent even after deletion, so a mistake means releasing the next patch version. That is the reason the artifact checks belong before the tag is pushed rather than after.

On the content

Written with X.Y.Z placeholders and no concrete version numbers, so it does not go stale the way a worked example would. No account names or contact details.

Every command in it was run verbatim before committing, including the four-way artifact loop, which passed for wheel and sdist in both modes.

test_documentation.py collects docs/*.md, docs/examples/*.md and README.md, so a root-level RELEASING.md is not executed by the suite. Confirmed rather than assumed. MANIFEST.in has include *.md, so it will ship in the sdist alongside CHANGELOG.md; say the word if you would rather exclude it.