docs: describe release notes for behavior changes and the tokenless publish workflow

[sadjow]

Two corrections to docs/RELEASING.md:

• It said the repository stores no npm token. The release workflow publishes through trusted publishing and never reads one, but an NPM_TOKEN repository secret still exists. The sentence now says the workflow needs no npm token, which stays true whether or not the secret is removed after the first trusted publishing release.
• changelogen writes CHANGELOG.md from commit titles, and the GitHub Release uses generated notes, so neither explains a behavior change. The next release includes one: visits tagged only with the new Google parameters from feat: capture GA4 campaign parameters and Google click IDs used on iOS and Display & Video 360 #223 now count as campaigns and add keys to attribution payloads. The release steps now say to add a short note to the generated section for changes like that and amend the release commit before pushing.

pnpm exec prettier --check docs/RELEASING.md passes.