Make workspace-core the default MCP profile

Flip bare pyro mcp serve, create_server(), and Pyro.create_server() to default to workspace-core in 4.0.0 while keeping workspace-full as the explicit advanced opt-in surface.

Rewrite the MCP-facing docs and host-specific examples around the bare default command, update package and catalog compatibility to 4.x, and move the public-contract wording from 3.x compatibility guidance to the new stable default.

Adjust the server, API, and contract tests so bare server creation now asserts the workspace-core tool set, while explicit workspace-full coverage continues to prove shells, services, snapshots, and disk tools remain available.

Validation: uv lock; .venv/bin/pytest --no-cov tests/test_cli.py tests/test_api.py tests/test_server.py tests/test_public_contract.py; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check; real guest-backed smoke for bare Pyro.create_server() plus explicit profile="workspace-full".

docs/install.md

@@ -85,7 +85,7 @@ uvx --from pyro-mcp pyro env list
 Expected output:
 
 ```bash
-Catalog version: 3.11.0
+Catalog version: 4.0.0
 debian:12 [installed|not installed] Debian 12 environment with Git preinstalled for common agent workflows.
 debian:12-base [installed|not installed] Minimal Debian 12 environment for shell and core Unix tooling.
 debian:12-build [installed|not installed] Debian 12 environment with Git and common build tools preinstalled.
@@ -231,16 +231,17 @@ After the CLI path works, you can move on to:
 - interactive shells: `pyro workspace shell open WORKSPACE_ID --id-only`
 - long-running services: `pyro workspace service start WORKSPACE_ID app --ready-file .ready -- sh -lc 'touch .ready && while true; do sleep 60; done'`
 - localhost-published ports: `pyro workspace create debian:12 --network-policy egress+published-ports` and `pyro workspace service start WORKSPACE_ID app --ready-http http://127.0.0.1:8080/ --publish 18080:8080 -- ./start-app`
-- MCP: `pyro mcp serve --profile workspace-core`
+- MCP: `pyro mcp serve`
 - Python SDK: `from pyro_mcp import Pyro`
 - Demos: `pyro demo` or `pyro demo --network`
 
 ## Chat Host Quickstart
 
-For most chat-host integrations, start with `workspace-core`:
+For most chat-host integrations, bare `pyro mcp serve` now starts
+`workspace-core`:
 
 ```bash
-uvx --from pyro-mcp pyro mcp serve --profile workspace-core
+uvx --from pyro-mcp pyro mcp serve
 ```
 
 Copy-paste host-specific starts:
@@ -253,25 +254,27 @@ Copy-paste host-specific starts:
 Claude Code:
 
 ```bash
-claude mcp add pyro -- uvx --from pyro-mcp pyro mcp serve --profile workspace-core
+claude mcp add pyro -- uvx --from pyro-mcp pyro mcp serve
 ```
 
 Codex:
 
 ```bash
-codex mcp add pyro -- uvx --from pyro-mcp pyro mcp serve --profile workspace-core
+codex mcp add pyro -- uvx --from pyro-mcp pyro mcp serve
 ```
 
 OpenCode uses the `mcp`/`type: "local"` config shape shown in
 [examples/opencode_mcp_config.json](../examples/opencode_mcp_config.json). If
 `pyro-mcp` is already installed, replace the `uvx --from pyro-mcp pyro`
-command with `pyro` in the same host-specific command or config shape.
+command with `pyro` in the same host-specific command or config shape. Use
+`--profile workspace-full` only when the host truly needs the full advanced
+workspace surface.
 
 Use profile progression like this:
 
-- `workspace-core`: recommended first profile for normal persistent chat editing
+- `workspace-core`: default and recommended first profile for normal persistent chat editing
 - `vm-run`: one-shot-only integrations
-- `workspace-full`: advanced 3.x compatibility surface when the host truly needs shells, services, snapshots, secrets, network policy, or disk tools
+- `workspace-full`: explicit advanced opt-in when the host truly needs shells, services, snapshots, secrets, network policy, or disk tools
 
 ## Stable Workspace
 
@@ -320,7 +323,7 @@ the identifier programmatically, use `--id-only` for only the identifier or `--j
 workspace payload. Use `--seed-path`
 when the workspace should start from a host directory or a local `.tar` / `.tar.gz` / `.tgz`
 archive. Use `pyro workspace sync push` for later host-side changes to a started workspace. Sync
-is non-atomic in `3.11.0`; if it fails partway through, prefer `pyro workspace reset` to recover
+is non-atomic in `4.0.0`; if it fails partway through, prefer `pyro workspace reset` to recover
 from `baseline` or one named snapshot. Use `pyro workspace diff` to compare the current workspace
 tree to its immutable create-time baseline, `pyro workspace snapshot *` to capture named
 checkpoints, and `pyro workspace export` to copy one changed file or directory back to the host. Use