docs(skill): add note on opting out of version pinning

Author: luarss

.claude/skills/release/SKILL.md

@@ -136,6 +136,12 @@ That grep should return no output.
 Note: `.mcp.json` and `.gemini/settings.json` use `uv run openroad-mcp` (local dev
 mode) and have no version to pin — skip them.
 
+> **Side note for users:** If you always want the latest version and prefer not
+> to pin, omit the `@vX.Y.Z` suffix and use the bare URL:
+> `git+https://github.com/luarss/openroad-mcp`. This trades supply chain
+> safety for convenience — acceptable for local/dev setups, not recommended
+> for shared or production environments.
+
 **uv.lock** — Regenerate by running `uv lock`. Do NOT hand-edit this file.
 
 **CHANGELOG.md** — Add new section before the previous version's section.
@@ -188,10 +194,10 @@ Do NOT push unless the user explicitly asks. The commit stays local for review.
   ```
   (replace `OLD_VERSION` with the actual previous version, e.g. `0\.5\.2`)
   before committing, to catch any missed references
-- Also verify the git URL manifests were updated:
+- Also verify the git URL manifests and README were updated:
   ```
-  grep -r "openroad-mcp@" .cursor/ .vscode/ .roo/ .kilocode/ opencode.json
+  grep -r "openroad-mcp@" README.md .cursor/ .vscode/ .roo/ .kilocode/ opencode.json
   ```
-  All five should show the new `@vX.Y.Z` tag
+  All six should show the new `@vX.Y.Z` tag
 - If `server.json` doesn't exist, skip it (some repos may not have it)
 - If `ROADMAP.md` doesn't exist or has no version table, skip it

README.md

@@ -78,6 +78,10 @@ The basic configuration for all MCP clients:
 }
 ```
 
+> **Note:** The URL above is pinned to a specific release for supply chain safety.
+> To always track the latest version instead, drop the `@v0.5.2` suffix:
+> `"git+https://github.com/luarss/openroad-mcp"`.
+
 For local development, use:
 
 ```json