Add host bootstrap and repair helpers

Add a dedicated pyro host surface for supported chat hosts so Claude Code, Codex, and OpenCode users can connect or repair the canonical MCP setup without hand-writing raw commands or config edits.

Implement the shared host helper layer and wire it through the CLI with connect, print-config, doctor, and repair, all generated from the same canonical pyro mcp serve command shape and project-source flags. Update the docs, public contract, examples, changelog, and roadmap so the helper flow becomes the primary onramp while raw host-specific commands remain as reference material.

Harden the verification path that this milestone exposed: temp git repos in tests now disable commit signing, socket-based port tests skip cleanly when the sandbox forbids those primitives, and make test still uses multiple cores by default but caps xdist workers to a stable value so make check stays fast and deterministic here.

Validation:
- uv lock
- UV_OFFLINE=1 UV_CACHE_DIR=.uv-cache make check
- UV_OFFLINE=1 UV_CACHE_DIR=.uv-cache make dist-check

examples/claude_code_mcp.md

@@ -2,6 +2,13 @@
 
 Recommended profile: `workspace-core`.
 
+Preferred helper flow:
+
+```bash
+pyro host connect claude-code
+pyro host doctor
+```
+
 Package without install:
 
 ```bash
@@ -23,9 +30,16 @@ If Claude Code launches the server from an unexpected cwd, pin the project
 explicitly:
 
 ```bash
+pyro host connect claude-code --project-path /abs/path/to/repo
 claude mcp add pyro -- uvx --from pyro-mcp pyro mcp serve --project-path /abs/path/to/repo
 ```
 
+If the local config drifts later:
+
+```bash
+pyro host repair claude-code
+```
+
 Move to `workspace-full` only when the chat truly needs shells, services,
 snapshots, secrets, network policy, or disk tools:
 

examples/codex_mcp.md

@@ -2,6 +2,13 @@
 
 Recommended profile: `workspace-core`.
 
+Preferred helper flow:
+
+```bash
+pyro host connect codex
+pyro host doctor
+```
+
 Package without install:
 
 ```bash
@@ -23,9 +30,16 @@ If Codex launches the server from an unexpected cwd, pin the project
 explicitly:
 
 ```bash
+pyro host connect codex --project-path /abs/path/to/repo
 codex mcp add pyro -- uvx --from pyro-mcp pyro mcp serve --project-path /abs/path/to/repo
 ```
 
+If the local config drifts later:
+
+```bash
+pyro host repair codex
+```
+
 Move to `workspace-full` only when the chat truly needs shells, services,
 snapshots, secrets, network policy, or disk tools:
 

examples/mcp_client_config.md

@@ -8,6 +8,14 @@ Use the host-specific examples first when they apply:
 - Codex: [examples/codex_mcp.md](codex_mcp.md)
 - OpenCode: [examples/opencode_mcp_config.json](opencode_mcp_config.json)
 
+Preferred repair/bootstrap helpers:
+
+- `pyro host connect claude-code`
+- `pyro host connect codex`
+- `pyro host print-config opencode`
+- `pyro host doctor`
+- `pyro host repair opencode`
+
 Use this generic config only when the host expects a plain `mcpServers` JSON
 shape.