ci(release): release next from a dedicated branch and restore requireCommits

[Upd4ting]

Summary

Adopt the branch-bound npm release channels from the updated organization reusable workflows (AntelopeJS/.github#10), matching AntelopeJS/antelopejs#155 and AntelopeJS/api#52:

• .github/workflows/release.yml: pin release-npm-public.yml to f4ce81591d09d271a480fd796e12a725cc973e0f. The reusable workflow now publishes latest only from the default branch and next only from a branch named next, passing --git.requireBranch=<branch> to release-it. The channel input, secrets and permissions are unchanged.
• .release-it.json: remove git.requireBranch (now supplied by the workflow) and keep git.requireCommits: true, which was already set.
• CONTRIBUTING.md: add a short "Releases" section pointing to the organization-wide release channels guide.

Related issue

Follow-up to AntelopeJS/.github#10; same change as AntelopeJS/antelopejs#155 and AntelopeJS/api#52.

Verification

• pnpm install --frozen-lockfile, pnpm prepack, pnpm lint, pnpm format:check, pnpm knip, pnpm test (96 passing): all pass.
• actionlint .github/workflows/release.yml (v1.7.7): no findings.
• pnpm exec release-it --ci --dry-run --no-npm.publish --git.requireBranch=ci/next-branch-releases: config parses, the requireCommits check passes (commits exist since v0.1.9), and the dry run resolves to v0.1.10. The local package.json bump from the dry run was reverted; no tag was created and nothing was published.

Checklist

• The pull request title follows Conventional Commits.
• I added or updated tests when behavior changed. N/A: CI and release configuration only.
• I updated documentation when users or contributors are affected.
• I documented breaking changes and migration steps. N/A: no breaking changes.
• I did not include credentials or unrelated changes.