fix: add contents:read to build job, clarify manual publish

- Build job needs contents:read for checkout (job-level perms replace
  workflow-level)
- Clarify that PyPI publishing is manually triggered, not automatic

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/publish-pypi.yml

@@ -15,6 +15,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     permissions:
+      contents: read
       actions: write
     steps:
       - name: Checkout release tag

.github/workflows/release.yml

@@ -82,7 +82,7 @@ jobs:
           uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION}
           \`\`\`
 
-          > **Note:** PyPI publishing runs shortly after this release is created. If the PyPI version is not yet available, use the source install command above.
+          > **Note:** PyPI publishing is triggered manually after this release. If the PyPI version is not yet available, use the source install command above.
 
           NOTES_EOF