docs(release): add the v0.1.0-alpha.5 notes

[wstein]

Adds the release notes docs/releases/v0.1.0-alpha.5.md. The release job fails before building without docs/releases/<tag>.md, and alpha.5 is the first single-archive release: its Known limits carry the three items that are unverified until the clean-Mac run of #505 (upload and attestation of the single archive, the Homebrew formula built from it, an install on a clean Apple-silicon Mac without gh, Homebrew or Command Line Tools). make release-prep is not used for an alpha; CHANGELOG.md is untouched.

After this PR is merged and ci on the merge commit is green, the human tags v0.1.0-alpha.5 (signed, annotated) on the merge commit.

Refs #443

🤖 Generated with Claude Code

[wstein]

Review evidence (Opus 5.5, independent reviewer, exact head b72ddcd, on current main ffe9c22, ci on main green):

• Round 1 (4cb29316): NOT CLEAR, one Medium (commit message without a why-body) and Lows, fixed. Round 2 (b72ddcd): CLEAR.
• Checked: release.yml needs docs/releases/${TAG}.md non-empty; the 14 merged PRs are in range (merge-base --is-ancestor); highlights trace to the commits' Refs trailers; the install block equals TEMPLATE.md with the tag filled in and is zsh-safe (zsh -n, simulated checksum step); archive, checksum and provenance names match goreleaser.yaml and release.yml; Known limits name all three unverified items and nothing unmeasured is claimed verified.
• make check-ci exit 0 (lychee 664 links, 0 errors, gitleaks clean). No Go file changed. AGENTS.md and CHANGELOG.md untouched.
• Not verified by anyone: a release build, gh attestation verify, the Homebrew formula and the clean-Mac install (all setup: install Homebrew from whr setup (option C of the bootstrap note) #505), and that the human's signing key is the key in .github/release-signers.