docs: name the required check version-forward + document planned ruleset migration (#308)

[StefanSteiner]

What & why

Documentation follow-up to #315 (which fixed the release-please -rc.N
backward-anchor regression, #308). Two corrections to
docs/GITHUB_OPERATIONS.md → Branch protection:

1. Correct the required-status-check name. The section told maintainers to
   require verify-release-pr-version — but that is the workflow file name.
   GitHub's required-check picker lists checks by their check-run (job) name,
   which is version-forward, so searching for the file name finds nothing. (This
   bit us for real: the check wasn't selectable in Settings → Branches until we
   searched for version-forward.) The bullet now names version-forward, links
   to the workflow file, and explains the file-vs-job distinction so the next
   maintainer doesn't hit the same wall.

2. Document the planned ruleset migration. Adds a note that main is guarded
   by GitHub's classic branch protection today, with a planned conversion to a
   ruleset
   after the 1.0.0 release ships — deliberately not during the
   release-candidate cycle, so branch-gating mechanics don't change mid-release.
   The note explains what rulesets add (layering, readable by anyone with repo
   access, unified branch + tag governance) and that classic rules and rulesets
   coexist (most-restrictive-wins), so the switch can be staged and verified
   without a protection gap.

Docs-only — no code or workflow behavior changes. markdownlint-cli2 clean.

Related: #308, #315.