🔧 chore: clarify mirror release source

[zrr1999]

Summary

• clarify that spore-pre-commit mirrors published PyPI releases, not unreleased spore main-branch changes
• make the README explicit about PyPI being the release discovery source even when the main spore repo has not cut the next public tag yet
• align the sync workflow action versions with the rest of the workspace baseline

Validation

• uvx prek run --files README.md .github/workflows/sync.yml

Notes

• This is preparatory sync work only; mirror tags still move strictly when a stable PyPI package exists.