docs: wait for CI on master to pass before pushing the release tag

Commits which were only local, such as security fixes, aren't tested
by CI until master is pushed. Pushing the tag at the same time meant a
CI failure in them could stop the release binaries being built, which
happened for the Windows build of v1.76.0.

RELEASE.md

@@ -32,10 +32,14 @@ This file describes how to make the various kinds of releases
 - git commit -a -v -m "Version v1.XX.0"
 - make check # if this fails, fix, git commit --amend and run it again
 - make retag # moves the tag onto the Version commit
-- git push origin # without --follow-tags so it doesn't push the tag if it fails
+- git push origin # without --follow-tags so it doesn't push the tag yet
+- Wait for the GitHub actions build of master to complete and check it is
+  green - this is the first time CI sees any commits which were only local,
+  such as security fixes, so it must pass before the tag is pushed
+  - if it fails: fix, git commit, make retag, git push origin and wait again
 - git push --follow-tags origin
-- \# Wait for the GitHub builds to complete then...
-- \# Don't commit anything until after make upload_github as these steps
+- \# Wait for the GitHub builds of the tag to complete then...
+- \# Don't commit or push anything until after make upload_github as these steps
   use the tag on HEAD to find the version
 - make fetch_binaries
 - make tarball