docs(readme): restructure Installation with a client decision guide

[mocha06]

What

Rewrites the README Installation section around the five ways to use the toolkit, so a first-time reader can quickly tell which path they want and how the paths differ.

• Decision guide — five one-liners mapping client/need → path.
• Comparison table — the columns that actually drive the choice: where the MCP server runs, tool surface, auth, what else it installs, and best-for.
• Reordered subsections (Hosted MCP → Claude Code plugin → Quick-install → CLI-only → Skills-only), each opening with a "Pick this when:" line.
• Recommendation note — Claude Code is the recommended, best-tested client; other clients (Cursor, Claude Desktop, Codex) are supported but still maturing.

Why

The prior section listed install methods as a flat set of subsections with no "which one do I pick?" guidance, and the key differentiator — hosted exposes a remote-safe subset of tools vs. all 185 locally — wasn't surfaced. This was confusing to follow as a first-time user.

Note

Renaming the install subsection headings changed their GitHub anchors, so this also updates the cross-file links in packages/mcp/README.md and skills/onboarding/pipefy-toolkit-setup/SKILL.md. Verified no dangling references to the old anchors remain.

[adriannoes]

This install restructure is the right shape: five paths, a comparison table, and "Pick this when" subsections make the choice greppable. Anchors and cross-links look consistent, CI is green, and there is nothing security-sensitive in the diff.

Please hold merge on one accuracy issue in the new Hosted row. The table and decision guide claim a remote-safe subset of roughly 76 of 185 tools limited to reads and discovery, and they send write needs to the Claude Code plugin. On this tip the remote seed is 179 of 185 and already includes create/update/delete; only six local-bound tools are withheld. That misstates the main Hosted vs plugin differentiator this PR is trying to teach. Requesting changes until the Hosted cell and the matching bullets match the allowlist (and until "writes require plugin" is reframed around local-only capabilities and CLI/slash ergonomics).

Separate note: if PR #497 merges first and the registry moves 185→186, refresh the totals when you land the wording fix so the guide does not churn twice.

[mocha06]

Good catch — confirmed and fixed in 716c17f. Verified on the branch tip: REMOTE_SEED is 179 of 185 (includes create_card, delete_pipe, etc.); only the 6 local-bound tools are withheld. Updated the Hosted cell to "179 of 185 (all but 6 local-bound tools)", dropped the reads-only framing, and reframed the decision bullets + both "Pick this when" lines around no-local-Python / no-CLI-or-slash-commands / the 6 local-only tools rather than reads-vs-writes.

[adriannoes]

The Hosted surface fix in 716c17f looks good and the review thread on that point is resolved.

Before I approve: please rebase (or merge) onto current dev and bump the Installation numbers to match post-#497 allowlists. On dev today that is 180 of 186 remote-safe (and 186 for the full local rows), not 179 of 185. The branch is still behind dev, so landing as-is would reintroduce a stale count right after merge.

Once the tip shows 180 of 186 (and local rows say 186) against an up-to-date dev base, I am happy to approve.