Harden release publishing and document release blockers

docs/RELEASING.md

@@ -103,6 +103,26 @@ The optional Desktop HQ zip is assembled by `tools/build_releases.sh` from
 `packaging/desktop_hq/`; keep `override.cfg` next to the extracted executable.
 It is not part of the default Compatibility/Web build.
 
+`tools/publish_release.sh` preflights every artifact for existence and non-zero
+size, checks free space in `build/`, writes `build/SHA256SUMS-<version>.txt`, and
+uploads only after those checks pass. If an upload or the final asset-count check
+fails, it removes the assets it just uploaded (and removes a newly created
+release) so the host never keeps a partial release. Use
+`PUBLISH_DRY_RUN=1 ./tools/publish_release.sh` to run the preflight and checksum
+steps without touching the API. Set `RETAIN_RELEASES=7` to prune older releases
+after a successful publish; the default `0` disables pruning and never deletes
+history implicitly. A retention of seven keeps the newest seven releases,
+including the latest 0.8/0.9 line.
+
+### 0.10.0 macOS signing decision
+
+The 0.10.0 release candidate will continue to ship an **unsigned** macOS zip with
+the documented right-click/`xattr` quarantine instructions. Signing and
+notarization remain a public-release blocker until an Apple Developer account and
+a reproducible signing/notarization job are available; they are not silently
+claimed as complete. The same limitation is recorded in
+[`known-limitations.md`](known-limitations.md).
+
 Always run the release build from a clean checkout or detached worktree. Godot
 can pack files from ignored `tmp/` and old `build/` folders into the PCK; the
 0.9.6 dirty-tree build produced 1.6–3.1 GB artifacts, while the clean worktree