ci(release): release next from a dedicated branch and restore requireCommits

[Upd4ting]

Summary

Adopt the branch-bound npm release channels introduced in the org reusable workflows (AntelopeJS/.github#10): latest is released only from the default branch and next only from a branch named next. The reusable workflow now passes --git.requireBranch=<branch> to release-it, so the repository config no longer hardcodes it.

• .github/workflows/release.yml: pin release-npm-public.yml to f4ce81591d09d271a480fd796e12a725cc973e0f (channel input, secrets and permissions unchanged).
• .release-it.json: remove git.requireBranch (supplied by the workflow); git.requireCommits stays true.
• CONTRIBUTING.md: add a short "Releases" section pointing to the organization-wide release channels guide.

Same change as AntelopeJS/antelopejs#155 and AntelopeJS/api#52.

Related issue

Follow-up of AntelopeJS/.github#10.

Verification

• pnpm lint, pnpm knip, pnpm test (77 passing), pnpm test:package: pass.
• pnpm format:check: fails on CHANGELOG.md only, which this PR does not touch (pre-existing, file last changed by chore(release): v0.1.0).
• pnpm exec release-it --ci --dry-run --no-npm.publish --git.requireBranch=ci/next-branch-releases --no-git.requireUpstream: config parses and the dry run completes (0.1.0 → 0.1.1); the local version bump was reverted. --no-git.requireUpstream was only needed because the local branch had no upstream yet.
• Same dry run with --git.requireBranch=next fails with Must be on branch next, as expected.
• actionlint is not available locally; the workflow change is a single SHA update.

Checklist

• The pull request title follows Conventional Commits.
• I added or updated tests when behavior changed. N/A (CI/config only)
• I updated documentation when users or contributors are affected.
• I documented breaking changes and migration steps. N/A (no breaking change)
• I did not include credentials or unrelated changes.