fix: address third review round

- Use job-level permissions: actions:write on build (for upload-artifact),
  actions:read on publish (for download-artifact)
- Include both @latest and pinned version in release notes
- Add note that PyPI may lag behind the GitHub release

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/release.yml

@@ -66,16 +66,24 @@ jobs:
           ## Install
 
           \`\`\`bash
-          uv tool install specify-cli==${VERSION_NO_V}
+          uv tool install specify-cli@latest
           specify init my-project
           \`\`\`
 
+          Or pin to this exact release:
+
+          \`\`\`bash
+          uv tool install specify-cli==${VERSION_NO_V}
+          \`\`\`
+
           Or install from source:
 
           \`\`\`bash
           uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION}
           \`\`\`
 
+          > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above.
+
           NOTES_EOF
 
           echo "## What's Changed" >> release_notes.md