fix: address third review round

- Use job-level permissions: actions:write on build (for upload-artifact),
  actions:read on publish (for download-artifact)
- Include both @latest and pinned version in release notes
- Add note that PyPI may lag behind the GitHub release

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/publish-pypi.yml

@@ -10,11 +10,12 @@ on:
 
 permissions:
   contents: read
-  actions: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
     steps:
       - name: Checkout release tag
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6

.github/workflows/release.yml

@@ -66,16 +66,24 @@ jobs:
           ## Install
 
           \`\`\`bash
-          uv tool install specify-cli==${VERSION_NO_V}
+          uv tool install specify-cli@latest
           specify init my-project
           \`\`\`
 
+          Or pin to this exact release:
+
+          \`\`\`bash
+          uv tool install specify-cli==${VERSION_NO_V}
+          \`\`\`
+
           Or install from source:
 
           \`\`\`bash
           uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION}
           \`\`\`
 
+          > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above.
+
           NOTES_EOF
 
           echo "## What's Changed" >> release_notes.md