Stop release candidates moving latest and the Latest release

docs/development/releasing.md offers a vX.Y.Z-rc.1 tag as a rehearsal, but release.yml treats every v* tag as final. Measured on v0.2.0-rc.1: :latest and :0.2.0-rc.1 both resolved to sha256:eca57197…, and the candidate became the repository's Latest release, because gh release create runs without --prerelease. That release was then corrected by hand with gh release edit.

The runbook then says to delete the rc's package versions. Deleting the version latest points at removes latest too, so the delete has to wait until the final tag has moved it.

Tag only the bare version and pass --prerelease when the tag holds a -, and have the runbook name the delete order.