docs: correct release verification workflow

[tisonkun]

Summary

• require the PGP signing key to contain an @apache.org user ID and report a clear error when it does not
• keep the Unreleased changelog section and add each release section below it
• make the GPG fingerprint verification command portable to BSD awk
• keep source-verification build artifacts outside the extracted archive and inspect the crate package before generating TCK snapshots
• publish the Git tag without creating a redundant GitHub Release

Validation

• cargo x lint
• parse all Bash blocks in RELEASE.md with bash -n
• verify the signing-key UID check against the configured Apache signing key
• run the complete release checks against a fresh download of the staged RC1 source archive