Add doc/RELEASING.md and reference it from POLICY.md and README.md

README.md

@@ -580,6 +580,7 @@ this repository. No document here defers to another repository.
 | [`doc/PLUGINS.md`](doc/PLUGINS.md) | The Recipe format, the plugin contract, and the catalogue of all 45 plugins |
 | [`doc/POLICY.md`](doc/POLICY.md) | How a change is made and judged: style, dependencies, tests, versioning |
 | [`doc/DEPLOYMENT.md`](doc/DEPLOYMENT.md) | Installing, scheduling, operating, and what to do when it fails |
+| [`doc/RELEASING.md`](doc/RELEASING.md) | For maintainers: building, verifying and publishing the gem |
 | [`doc/VERSIONS`](doc/VERSIONS) | The release history, from 2012 |
 | [`doc/LICENSE.md`](doc/LICENSE.md) | The licence |
 | [`doc/COPYING`](doc/COPYING) | The GPLv3 text |

doc/POLICY.md

@@ -625,6 +625,12 @@ not install an AWS SDK.
   resolution on every consumer.
 - `Rakefile` carries the test tasks and nothing else. It is not a build system,
   and no build system is introduced.
+- A release requires green required CI. Its built gem is inspected and installed
+  locally before publication, and its source version and metadata must agree.
+- A published version is immutable. Credentials are never committed, and
+  release commits and tags are not rewritten to conceal a publication error.
+- The manual publication procedure is [`RELEASING.md`](RELEASING.md). Publishing
+  is an explicit maintainer action, not a side effect of a build or test task.
 
 ---