Add host bootstrap and repair helpers

Add a dedicated pyro host surface for supported chat hosts so Claude Code, Codex, and OpenCode users can connect or repair the canonical MCP setup without hand-writing raw commands or config edits.

Implement the shared host helper layer and wire it through the CLI with connect, print-config, doctor, and repair, all generated from the same canonical pyro mcp serve command shape and project-source flags. Update the docs, public contract, examples, changelog, and roadmap so the helper flow becomes the primary onramp while raw host-specific commands remain as reference material.

Harden the verification path that this milestone exposed: temp git repos in tests now disable commit signing, socket-based port tests skip cleanly when the sandbox forbids those primitives, and make test still uses multiple cores by default but caps xdist workers to a stable value so make check stays fast and deterministic here.

Validation:
- uv lock
- UV_OFFLINE=1 UV_CACHE_DIR=.uv-cache make check
- UV_OFFLINE=1 UV_CACHE_DIR=.uv-cache make dist-check

README.md

@@ -30,7 +30,7 @@ SDK-first platform.
 - Troubleshooting: [docs/troubleshooting.md](docs/troubleshooting.md)
 - Stable workspace walkthrough GIF: [docs/assets/workspace-first-run.gif](docs/assets/workspace-first-run.gif)
 - Terminal walkthrough GIF: [docs/assets/first-run.gif](docs/assets/first-run.gif)
-- What's new in 4.1.0: [CHANGELOG.md#410](CHANGELOG.md#410)
+- What's new in 4.2.0: [CHANGELOG.md#420](CHANGELOG.md#420)
 - PyPI package: [pypi.org/project/pyro-mcp](https://pypi.org/project/pyro-mcp/)
 
 ## Who It's For
@@ -76,7 +76,7 @@ What success looks like:
 ```bash
 Platform: linux-x86_64
 Runtime: PASS
-Catalog version: 4.1.0
+Catalog version: 4.2.0
 ...
 [pull] phase=install environment=debian:12
 [pull] phase=ready environment=debian:12
@@ -96,9 +96,26 @@ for the guest image.
 ## Chat Host Quickstart
 
 After the quickstart works, the intended next step is to connect a chat host.
-From a repo root, bare `pyro mcp serve` starts `workspace-core`, auto-detects
-the current Git checkout, and lets the first `workspace_create` omit
-`seed_path`.
+Use the helper flow first:
+
+```bash
+uvx --from pyro-mcp pyro host connect claude-code
+uvx --from pyro-mcp pyro host connect codex
+uvx --from pyro-mcp pyro host print-config opencode
+```
+
+If setup drifts or you want to inspect it first:
+
+```bash
+uvx --from pyro-mcp pyro host doctor
+uvx --from pyro-mcp pyro host repair claude-code
+uvx --from pyro-mcp pyro host repair codex
+uvx --from pyro-mcp pyro host repair opencode
+```
+
+Those helpers wrap the same `pyro mcp serve` entrypoint. From a repo root,
+bare `pyro mcp serve` starts `workspace-core`, auto-detects the current Git
+checkout, and lets the first `workspace_create` omit `seed_path`.
 
 ```bash
 uvx --from pyro-mcp pyro mcp serve
@@ -107,12 +124,14 @@ uvx --from pyro-mcp pyro mcp serve
 If the host does not preserve the server working directory, use:
 
 ```bash
+uvx --from pyro-mcp pyro host connect codex --project-path /abs/path/to/repo
 uvx --from pyro-mcp pyro mcp serve --project-path /abs/path/to/repo
 ```
 
 If you are starting outside a local checkout, use a clean clone source:
 
 ```bash
+uvx --from pyro-mcp pyro host connect codex --repo-url https://github.com/example/project.git
 uvx --from pyro-mcp pyro mcp serve --repo-url https://github.com/example/project.git
 ```
 
@@ -149,7 +168,8 @@ OpenCode `opencode.json` snippet:
 }
 ```
 
-If OpenCode launches the server from an unexpected cwd, add
+If OpenCode launches the server from an unexpected cwd, use
+`pyro host print-config opencode --project-path /abs/path/to/repo` or add
 `"--project-path", "/abs/path/to/repo"` after `"serve"` in the same command
 array.
 
@@ -163,9 +183,9 @@ snapshots, secrets, network policy, or disk tools.
 
 1. Validate the host with `pyro doctor`.
 2. Pull `debian:12` and prove guest execution with `pyro run debian:12 -- git --version`.
-3. Connect Claude Code, Codex, or OpenCode with `pyro mcp serve` from a repo
-   root, or use `--project-path` / `--repo-url` when cwd is not the source of
-   truth.
+3. Connect Claude Code, Codex, or OpenCode with `pyro host connect ...` or
+   `pyro host print-config opencode`, then fall back to raw `pyro mcp serve`
+   with `--project-path` / `--repo-url` when cwd is not the source of truth.
 4. Start with one recipe from [docs/use-cases/README.md](docs/use-cases/README.md).
    `repro-fix-loop` is the shortest chat-first story.
 5. Use `make smoke-use-cases` as the trustworthy guest-backed verification path