Make workspace-core the default MCP profile

Flip bare pyro mcp serve, create_server(), and Pyro.create_server() to default to workspace-core in 4.0.0 while keeping workspace-full as the explicit advanced opt-in surface.

Rewrite the MCP-facing docs and host-specific examples around the bare default command, update package and catalog compatibility to 4.x, and move the public-contract wording from 3.x compatibility guidance to the new stable default.

Adjust the server, API, and contract tests so bare server creation now asserts the workspace-core tool set, while explicit workspace-full coverage continues to prove shells, services, snapshots, and disk tools remain available.

Validation: uv lock; .venv/bin/pytest --no-cov tests/test_cli.py tests/test_api.py tests/test_server.py tests/test_public_contract.py; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check; real guest-backed smoke for bare Pyro.create_server() plus explicit profile="workspace-full".

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable user-visible changes to `pyro-mcp` are documented here.
 
+## 4.0.0
+
+- Flipped the default MCP/server profile from `workspace-full` to
+  `workspace-core`, so bare `pyro mcp serve`, `create_server()`, and
+  `Pyro.create_server()` now match the recommended narrow chat-host path.
+- Rewrote MCP-facing docs and shipped host-specific examples so the normal
+  setup path no longer needs an explicit `--profile workspace-core` just to
+  get the default behavior.
+- Added migration guidance for hosts that relied on the previous implicit full
+  surface: they now need `--profile workspace-full` or
+  `create_server(profile=\"workspace-full\")`.
 ## 3.11.0
 
 - Added first-class host-specific MCP onramps for Claude Code, Codex, and