fix: use .NET Regex.Replace for count-limited replacement in PowerShell

Addresses Copilot feedback: PowerShell's -replace operator does not
support a third argument for replacement count. Using it causes an
error or mis-parsing that would break forge package generation on
Windows.

Changed from:
  $content -replace '(?m)^---$', "---`nname: $cmdName", 1

To:
  $regex = [regex]'(?m)^---$'
  $content = $regex.Replace($content, "---`nname: $cmdName", 1)

The .NET Regex.Replace() method properly supports the count parameter,
ensuring the name field is injected only after the first frontmatter
delimiter (not the closing one).

This fix is critical for Windows users running:
  specify init --ai forge --offline

.github/workflows/scripts/create-release-packages.ps1

@@ -498,8 +498,9 @@ function Build-Variant {
                 $cmdName = [System.IO.Path]::GetFileNameWithoutExtension($cmdFile.Name)
                 $content = Get-Content -Path $cmdFile.FullName -Raw
                 
-                # Inject name field after first ---
-                $content = $content -replace '(?m)^---$', "---`nname: $cmdName", 1
+                # Inject name field after first --- using .NET Regex.Replace with count limit
+                $regex = [regex]'(?m)^---$'
+                $content = $regex.Replace($content, "---`nname: $cmdName", 1)
                 
                 Set-Content -Path $cmdFile.FullName -Value $content -NoNewline
             }