Fix silent failures in publish-wheels.sh (masked twine errors, skipped confirmations)

[ciaranra]

Two robustness bugs in scripts/publish-wheels.sh, both of which bit during the 0.9.0.dev0 publish:

1. Error-masked twine check. The check piped twine's output through grep -v license-file, so the if tested grep's exit status — a failed or even missing twine ("Failed to spawn: twine") still printed "Distribution checks passed". Now the output is captured once and twine's own exit status decides (twine exits nonzero on real errors, zero on the benign maturin license-file warning, which is still filtered from the display).

2. Piped confirmation skipped a package. The per-package prompt used read -n 1, so piping yes fed y to the first prompt and the leftover \n to the second — during the 0.9.0.dev0 publish this silently skipped pecos-rslib-llvm, briefly leaving quantum-pecos on PyPI with an unresolvable exact pin (caught and uploaded directly). Fixed twofold: the prompt now reads a full line, and a -y/--yes flag supports non-interactive use without piping tricks.

Verification: bash -n clean; side-by-side read semantics demonstrate the old bug and the fix (old read 2: [] vs new read 2: [y] under piped yes); --dry-run against the real 0.9.0.dev0 distribution bundle passes all three package checks with the new logic.

[ciaranra]

Added RELEASING.md to this PR: the full manual release sequence as exercised for 0.9.0.dev0 (coordinated version bump -> post-merge green -> tag -> tag-run bundle -> dry-run -> manual per-package publish -> GitHub release -> fresh-venv verification from PyPI). The publish step stays deliberately manual with a human confirming each upload.