Clarify workspace-core as the chat-host onramp

Make the recommended MCP profile visible from the first help and docs pass without changing 3.x behavior.

Rework  help, top-level docs, public-contract wording, and shipped MCP/OpenAI examples so  is the recommended first profile while  stays the compatibility default for full-surface hosts.

Bump the package and catalog to 3.8.0, mark the roadmap milestone done, and add regression coverage for the new MCP help and docs alignment. Validation included uv lock, targeted profile/help tests, make check, make dist-check, and a real guest-backed  server smoke.

README.md

@@ -23,7 +23,7 @@ It exposes the same runtime in three public forms:
 - Stable workspace walkthrough GIF: [docs/assets/workspace-first-run.gif](docs/assets/workspace-first-run.gif)
 - Terminal walkthrough GIF: [docs/assets/first-run.gif](docs/assets/first-run.gif)
 - PyPI package: [pypi.org/project/pyro-mcp](https://pypi.org/project/pyro-mcp/)
-- What's new in 3.7.0: [CHANGELOG.md#370](CHANGELOG.md#370)
+- What's new in 3.8.0: [CHANGELOG.md#380](CHANGELOG.md#380)
 - Host requirements: [docs/host-requirements.md](docs/host-requirements.md)
 - Integration targets: [docs/integrations.md](docs/integrations.md)
 - Public contract: [docs/public-contract.md](docs/public-contract.md)
@@ -60,7 +60,7 @@ What success looks like:
 ```bash
 Platform: linux-x86_64
 Runtime: PASS
-Catalog version: 3.7.0
+Catalog version: 3.8.0
 ...
 [pull] phase=install environment=debian:12
 [pull] phase=ready environment=debian:12
@@ -125,6 +125,7 @@ That stable workspace path gives you:
 After the quickstart works:
 
 - prove the full one-shot lifecycle with `uvx --from pyro-mcp pyro demo`
+- start most chat hosts with `uvx --from pyro-mcp pyro mcp serve --profile workspace-core`
 - create a persistent workspace with `uvx --from pyro-mcp pyro workspace create debian:12 --seed-path ./repo`
 - add a human-friendly workspace name with `uvx --from pyro-mcp pyro workspace create debian:12 --name repro-fix --label issue=123`
 - rediscover or retag workspaces with `uvx --from pyro-mcp pyro workspace list` and `uvx --from pyro-mcp pyro workspace update WORKSPACE_ID --label owner=codex`
@@ -144,6 +145,35 @@ After the quickstart works:
 - inspect or export one stopped guest rootfs with `uvx --from pyro-mcp pyro workspace disk list WORKSPACE_ID`, `uvx --from pyro-mcp pyro workspace disk read WORKSPACE_ID note.txt`, and `uvx --from pyro-mcp pyro workspace disk export WORKSPACE_ID --output ./workspace.ext4`
 - move to Python or MCP via [docs/integrations.md](docs/integrations.md)
 
+## Chat Host Quickstart
+
+For most MCP chat hosts, start with `workspace-core`. It exposes the practical
+persistent editing loop without shells, services, snapshots, secrets, network
+policy, or disk tools.
+
+```bash
+uvx --from pyro-mcp pyro mcp serve --profile workspace-core
+```
+
+Minimal MCP config:
+
+```json
+{
+  "mcpServers": {
+    "pyro": {
+      "command": "uvx",
+      "args": ["--from", "pyro-mcp", "pyro", "mcp", "serve", "--profile", "workspace-core"]
+    }
+  }
+}
+```
+
+Profile progression:
+
+- `workspace-core`: recommended first profile for normal persistent chat editing
+- `vm-run`: smallest one-shot-only surface
+- `workspace-full`: advanced 3.x compatibility surface when the chat truly needs shells, services, snapshots, secrets, network policy, or disk tools
+
 ## Supported Hosts
 
 Supported today:
@@ -195,7 +225,7 @@ uvx --from pyro-mcp pyro env list
 Expected output:
 
 ```bash
-Catalog version: 3.7.0
+Catalog version: 3.8.0
 debian:12 [installed|not installed] Debian 12 environment with Git preinstalled for common agent workflows.
 debian:12-base [installed|not installed] Minimal Debian 12 environment for shell and core Unix tooling.
 debian:12-build [installed|not installed] Debian 12 environment with Git and common build tools preinstalled.
@@ -312,7 +342,7 @@ machine consumption, use `--id-only` for only the identifier or `--json` for the
 workspace payload. Use `--seed-path` when
 you want the workspace to start from a host directory or a local `.tar` / `.tar.gz` / `.tgz`
 archive instead of an empty workspace. Use `pyro workspace sync push` when you want to import
-later host-side changes into a started workspace. Sync is non-atomic in `3.7.0`; if it fails
+later host-side changes into a started workspace. Sync is non-atomic in `3.8.0`; if it fails
 partway through, prefer `pyro workspace reset` to recover from `baseline` or one named snapshot.
 Use `pyro workspace diff` to compare the live `/workspace` tree to its immutable create-time
 baseline, and `pyro workspace export` to copy one changed file or directory back to the host. Use
@@ -404,7 +434,8 @@ pyro doctor --json
 It fails closed when guest boot or guest exec is unavailable.
 Use `--allow-host-compat` only if you explicitly want host execution.
 
-Run the MCP server after the CLI path above works:
+Run the MCP server after the CLI path above works. Start most chat hosts with
+`workspace-core`:
 
 ```bash
 pyro mcp serve --profile workspace-core
@@ -412,9 +443,9 @@ pyro mcp serve --profile workspace-core
 
 Profile progression for chat hosts:
 
-- `vm-run`: expose only `vm_run`
-- `workspace-core`: expose the practical persistent chat loop
-- `workspace-full`: expose shells, services, snapshots, secrets, network policy, and disk tools
+- `workspace-core`: recommended first profile for normal persistent chat editing
+- `vm-run`: expose only `vm_run` for one-shot-only hosts
+- `workspace-full`: expose shells, services, snapshots, secrets, network policy, and disk tools when the chat truly needs the full stable surface
 
 Run the deterministic demo: