release instructions: make clear what to do before signing the release candidate

[alexkli]

It's key to do at least these in the sources that will go into the release before starting the signing/build release process:

• npm: release version in package.json
• up to date CHANGELOG

But it's not very clear from the document... could be highlighted more.