Improve release automation

[nueces]

Summary

• Move website PR creation from Start release to Publish release
• Open the website PR only after the release tag/GitHub release exists
• Update release bumps to include the README install tag
• Keep dev bumps from changing the README
• Add guardrails for expected diff size:
  • release PR: 4 insertions / 4 deletions
  • dev-bump PR: 3 insertions / 3 deletions
• Validate README release PR changes only touch the install command tag

Why

The website PR CI was failing before the release tag existed. Creating that PR after publish avoids the expected failure/re-run loop.

The README install command should also stay current without adding a moving stable branch or requiring manual edits.