fix: address review - python setup, docs alignment, publish flag

- Use actions/setup-python (pinned v6, Python 3.13) instead of
  uv python install for deterministic builds
- Use python instead of python3 for setup-python compatibility
- Remove unsupported --trusted-publishing always flag from uv publish
  (OIDC is auto-detected with id-token: write)
- Update README install to lead with PyPI, source as fallback
- Update installation guide: replace PyPI disclaimer with official
  package note, add PyPI as primary install method
- Release notes: pin to exact version, clarify PyPI timing

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/release.yml

@@ -65,15 +65,11 @@ jobs:
           cat > release_notes.md << NOTES_EOF
           ## Install
 
-          \`\`\`bash
-          uv tool install specify-cli
-          specify init my-project
-          \`\`\`
-
-          Or pin to this exact release:
+          From [PyPI](https://pypi.org/project/specify-cli/):
 
           \`\`\`bash
           uv tool install specify-cli==${VERSION_NO_V}
+          specify init my-project
           \`\`\`
 
           Or install from source:
@@ -82,7 +78,7 @@ jobs:
           uv tool install specify-cli --from git+https://github.com/github/spec-kit.git@${VERSION}
           \`\`\`
 
-          > **Note:** PyPI publishing is triggered manually after this release. If the PyPI version is not yet available, use the source install command above.
+          > **Note:** The PyPI package is published after this GitHub release. If the version is not yet available on PyPI, use the source install above.
 
           NOTES_EOF