docs: address CodeRabbit nitpick on release-procedure.md lockstep wording

PR #751 CodeRabbit review flagged that the "Bump all five version sites in
lockstep" wording was ambiguous — the table below explicitly treats
`packages/installer/package.json` as conditional ("patch bump if installer
changed; otherwise leave"). Operators reading only line 36 could over-bump
the installer.

Reworded to distinguish:
- Root + internal manifest + compat: MUST stay in lockstep at same version
- packages/installer: bumped ONLY when installer source changed (not every release)

Also explicit on the two failure-mode detection layers:
- Smoke tests (catch silent publish mismatches)
- validate-aiox-core-namespace.js wired into validate:publish (rule 4 enforces lockstep)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: rafaelscosta

docs/guides/release-procedure.md

@@ -33,9 +33,12 @@ Block the release if any of these are red.
 
 ## Version bump (T-5 minutes)
 
-Bump **all five** version sites in lockstep. Mismatches cause silent publish
-failures that only show up in the smoke tests OR are caught by
-`validate-aiox-core-namespace.js` (which is wired into `validate:publish`).
+Review **all five** version sites during release prep. The root surface, the
+internal manifest, and the compat wrapper MUST stay in lockstep at the same
+version. `packages/installer/package.json` is bumped **only** when installer
+source changed — not on every release. Mismatches cause silent publish failures
+that show up in the smoke tests OR are caught by
+`validate-aiox-core-namespace.js` (wired into `validate:publish`).
 
 | File | What to bump |
 |---|---|