docs: record the setting release-please needs to open a PR

It is off by default: Settings -> Actions -> General -> Workflow
permissions -> 'Allow GitHub Actions to create and approve pull requests'.

Without it the workflow does everything right — reads the manifest,
computes 0.1.0 -> 0.1.1, creates the branch — and then fails on the final
API call. The symptom is a stale release-please--branches--main--* branch
and a red check with no obvious cause in the config.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

docs/GOING-PUBLIC.md

@@ -24,6 +24,14 @@ These change how merges behave, and the release automation depends on them.
 - [ ] **Settings → General → Pull Requests** → enable **Automatically delete head
       branches**
 
+- [ ] **Settings → Actions → General → Workflow permissions** → tick **Allow GitHub
+      Actions to create and approve pull requests**
+
+  > **release-please cannot work without this.** It is off by default. The workflow
+  > otherwise runs, computes the next version, creates its branch, and then fails at the
+  > final step with "GitHub Actions is not permitted to create or approve pull requests".
+  > A stale `release-please--branches--main--...` branch is the symptom.
+
 - [ ] **Settings → Rules → Rulesets** (or Branches → branch protection) for `main`:
   - [ ] Require a pull request before merging
   - [ ] Require status checks to pass, and select: