ci: cut release without opening a PR

GITHUB_TOKEN cannot create PRs unless a separate repo setting is enabled,
and the PR path still needs review under the main ruleset. Commit the
changelog on main, tag, and publish directly instead. Document the need
for a GitHub Actions ruleset bypass (or RELEASE_GITHUB_TOKEN).