Correct the merge advice for a library release

[joeferner]

The note added with 0.2.0 said the merge in step 4 "needs
gh pr merge --admin". It was written from the shape of the problem
rather than from having run it, and when it was run the merge came back
with Required status check "package verifies" is failing despite the
account holding admin on the repository.

The reason is that main is protected by a ruleset, not by classic
branch protection, and the two differ exactly here: a ruleset grants
bypass only to the actors named in bypass_actors, so an empty list
refuses a repository admin like anyone else. Whether --admin works is
therefore a property of the ruleset's configuration and not of who is
running it, which is worth a reader checking rather than assuming.

The section now gives both routes and what each costs. The second one is
worth having written down even where the bypass is available: dispatching
the release job against the branch publishes the version, which turns the
one red check green on its own and lets the pull request merge with no
bypass at all. That is safe to follow with a tag on main because the
publish step already asks the sparse index whether the version exists and
skips it if so -- the idempotence that was put there for re-running a
failed release turns out to make this ordering work too.