Refuse a release tag on code no release candidate ran

Step 3 of docs/development/releasing.md tags the release "on the same commit unless the validation produced fixes", and nothing checks it. So a final tag can land on controller code that no candidate ran, and the release notes still describe the candidate's upgrade test as if it covered that code.

This nearly happened in v0.2.0. v0.2.0-rc.1 was cut at 5b80a64. Then #128, the VPA poller plus an RBAC change, merged at 7939147, and #129's draft notes said the candidate was "tagged at the commit this release is tagged at". Someone read that line by hand before the tag and caught it, and v0.2.0-rc.2 was cut at 7939147.

Karl's constraint (2026-11-09): changes made after a candidate that touch only docs and the website don't need a fresh candidate. So the check should allow those and refuse anything else:

• On a vX.Y.Z tag with no -rc, release.yml finds the newest vX.Y.Z-rc.N tag and fails before it publishes anything if there is none.
• It also fails if git diff --name-only <rc> <tag> lists any path outside docs/** and website/**. Whether top-level Markdown such as README.md and SECURITY.md also counts as docs-only is still open.
• Step 3 of releasing.md changes to describe the same rule.

A tag push can't be undone without deleting the tag, so this check must fail before the image and chart jobs run, not after.