Follow up on #638 - fix pypi publish action version handling

The previous version (v1.12.4) should not have `keep: true` as it's not the
newest version. Also updates README to better document the process of adding
older vs newer versions of already approved actions.

Generated-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: potiuk

README.md

@@ -217,11 +217,25 @@ If you need to add a specific version of an already approved action (especially
 ```yaml
 existing/action:
   '<exact-commit-sha>':
-    expires_at: 2025-01-01
     keep: true
     tag: vX.Y.Z
 ```
 
+if this is the newest version of the action (make sure to remove the `keep: true` from the
+previously newest version and add `expires_at: <date>` to it, if you want to set an expiration date for it),
+
+or
+
+```yaml
+existing/action:
+  '<exact-commit-sha>':
+    expires_at: 2025-01-01
+    tag: vX.Y.Z
+```
+
+If you add older version of the action and want to set an expiration date for it.
+
+
 3. **Create a PR** against the `main` branch
 4. **Include in your PR description**:
    - Specific reason why this version is required

actions.yml

@@ -698,7 +698,6 @@ pypa/gh-action-pypi-publish:
     keep: true
     tag: v1.13.0
   76f52bc884231f62b9a034ebfe128415bbaabdfc:
-    keep: true
     tag: v1.12.4
     expires_at: 2026-06-10
 pyTooling/Actions: