docs: correct the release recipe for branch-protected master (#4)

The Releasing recipe told maintainers to commit the version bump and push
straight to master, but master requires a pull request (and an approving
review). Update the recipe to: bump both version locations + refresh uv.lock,
land the bump via a PR, then cut the Release on master with an explicit
--target.

Co-authored-by: Leonard Janke <lcjanke2020@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>