docs: clarify withholding approval skips npm publishing

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Sergiu Oala

.github/workflows/npm-publish.yml

@@ -75,12 +75,12 @@ jobs:
           node-version: 26.x
           registry-url: https://registry.npmjs.org
 
-      - name: publish to npm
+      - name: npm stage publish
         env:
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
           if [[ "$RELEASE_TAG" == *-rc* ]]; then
-            npm publish --provenance --tag rc
+            npm stage publish --provenance --tag rc
           else
-            npm publish --provenance
+            npm stage publish --provenance
           fi

README.md

@@ -548,9 +548,9 @@ make codestyle-fix
 Releases are automated with [release-please](https://github.com/googleapis/release-please#readme). Versioning comes from conventional commits on `master` (`fix:` patches, `feat:` minor, `!` / `BREAKING CHANGE` major). `chore:` does not bump. There is a **single** shared Release PR; RC and stable take turns on it.
 
 1. Merge `fix:` / `feat:` PRs into `master`. `release-please` opens or updates that PR as a **release candidate** (`X.Y.Z-rc`, then `X.Y.Z-rc.1`, …). `package.json` on the PR is already the version that will be tagged.
-2. Merge the RC PR when you want to cut an RC. `release-please` tags a GitHub **prerelease** (`vX.Y.Z-rc`) and dispatches `npm-publish`. Approve the **Publish** environment to publish to npm with dist-tag `rc`; withhold approval to skip npm (the git tag still exists).
+2. Merge the RC PR when you want to cut an RC. `release-please` tags a GitHub **prerelease** (`vX.Y.Z-rc`) and dispatches `npm-publish`. Approve the **Publish** environment to run `npm stage publish --provenance --tag rc`; withhold approval to skip staging (the git tag still exists). A maintainer then approves the staged package on npm (2FA) before it is installable.
 3. After the RC merge, the shared PR is rewritten as the matching **stable** Release PR (`X.Y.Z`).
-4. Merge that stable PR to ship `X.Y.Z` (GitHub Release + `npm-publish` without `--tag rc`, npm dist-tag `latest`). Same **Publish** approval gate.
+4. Merge that stable PR to ship `X.Y.Z` (GitHub Release + `npm stage publish --provenance`, npm dist-tag `latest` after npm approval). Same **Publish** environment gate, then npm 2FA approve.
 5. Further `fix:` / `feat:` commits on `master` while the stable PR is still open rewrite it into the **next RC** (`X.Y.Z-rc.1`, …) instead of shipping that stable. Use that when you want another candidate; merge stable with no extra bumping commits when you want to publish `latest`.
 
 ## License