docs(releasing): Document the two-PR flow for cmd/s2-server

[mojatter]

The release guide described a single PR that bumps every submodule — including cmd/s2-server — and tags all seven modules at once. That does not work: cmd/s2-server has no replace directives, so its GOWORK=off build (the e2e image via server/Dockerfile, and the GoReleaser binary) resolves intra-repo deps from proxy.golang.org and cannot fetch a version whose tag does not exist yet. Both v0.11.0 (#119 → #120) and v0.11.1 (#130 → #131) actually used a two-PR flow.

This rewrites the flow to match reality:

• Step 1 bumps only the five modules that carry replace directives; cmd/s2-server is explicitly excluded.
• Step 2 tags six modules (root + five submodules), not seven. Adds a note that the binary built at the root tag still links the previous library version, why that is fine for dependency/security bumps (MVS picks the higher version pinned directly in cmd/s2-server/go.mod, e.g. golang.org/x/net), and when to reorder.
• Step 3 (new) bumps cmd/s2-server in a follow-up PR once the tags are published, then tags cmd/s2-server/v*.
• Step 4 is the former step 3 (release notes), example versions refreshed to v0.11.1.
• The matching gotcha bullet is updated to point at the new step 3.