fix(release): verify script installs only from the given index, wheel-only

Review findings:
- UV_FIND_LINKS / extra-index env vars or a uv.toml could redirect the
  install to a local build and false-pass the gate; now --no-config on
  every uv call and refuse to run when an index-redirecting var is set
- an sdist fallback would build with backends fetched from TestPyPI;
  install the package with --only-binary :all:
- show the package install (no -q) so the log records what was installed
- changelog: note the removed [dev] extra

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -11,6 +11,8 @@ Hotfix. In 0.2.2, `import app_skellington` raised
  * Tested on Linux, CPython 3.8–3.14 (Gitea CI). Each version builds the wheel
    and sdist, installs them and smoke-tests the import.
  * Tooling: ruff replaces black/isort/flake8; uv with a committed lockfile.
+ * Removed the `[dev]` extra: `pip install app_skellington[dev]` no longer
+   installs dev tools. Contributors use `uv sync` (a PEP 735 dependency group).
  * Metadata: license classifier corrected to MIT-0; Python version classifiers
    added; "OS Independent" replaced by Linux (Windows and macOS untested).
  * README: the debug variable is `APPSKELLINGTON_DEBUG`.