Say in the plan what a release actually is

The previous commit meant to do this and edited a heading that exists only in
the planning notes, not in PLAN.md -- so the replacement matched nothing and
said nothing, which is the failure mode this file is half a catalogue of.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

PLAN.md

@@ -576,7 +576,13 @@ seen working.
 - [ ] Documentation, a fresh install, and an upgrade from an 0.8.x database
 
 ### Phase 9 — 1.0.0
-- [ ] A commit that changes the version, this file and the README, and tags it
+- [ ] A commit that changes the version, `CHANGELOG.md`, this file and the
+      README, and nothing else
+- [ ] A **signed annotated tag** whose message is the 1.0.0 changelog entry.
+      Not decoration: `/admin/updates` reads release notes out of the tag
+      object, so the tag message is what an administrator sees on that page
+- [ ] The deployment moves to the `stable` channel, which has something to
+      follow for the first time
 
 ---