Make workspace-core the default MCP profile

Flip bare pyro mcp serve, create_server(), and Pyro.create_server() to default to workspace-core in 4.0.0 while keeping workspace-full as the explicit advanced opt-in surface.

Rewrite the MCP-facing docs and host-specific examples around the bare default command, update package and catalog compatibility to 4.x, and move the public-contract wording from 3.x compatibility guidance to the new stable default.

Adjust the server, API, and contract tests so bare server creation now asserts the workspace-core tool set, while explicit workspace-full coverage continues to prove shells, services, snapshots, and disk tools remain available.

Validation: uv lock; .venv/bin/pytest --no-cov tests/test_cli.py tests/test_api.py tests/test_server.py tests/test_public_contract.py; UV_CACHE_DIR=.uv-cache make check; UV_CACHE_DIR=.uv-cache make dist-check; real guest-backed smoke for bare Pyro.create_server() plus explicit profile="workspace-full".

examples/mcp_client_config.md

@@ -1,6 +1,6 @@
 # MCP Client Config Example
 
-Recommended default for most chat hosts: `workspace-core`.
+Default for most chat hosts in `4.x`: `workspace-core`.
 
 Use the host-specific examples first when they apply:
 
@@ -20,7 +20,7 @@ Generic stdio MCP configuration using `uvx`:
   "mcpServers": {
     "pyro": {
       "command": "uvx",
-      "args": ["--from", "pyro-mcp", "pyro", "mcp", "serve", "--profile", "workspace-core"]
+      "args": ["--from", "pyro-mcp", "pyro", "mcp", "serve"]
     }
   }
 }
@@ -33,7 +33,7 @@ If `pyro-mcp` is already installed locally, the same server can be configured wi
   "mcpServers": {
     "pyro": {
       "command": "pyro",
-      "args": ["mcp", "serve", "--profile", "workspace-core"]
+      "args": ["mcp", "serve"]
     }
   }
 }
@@ -41,9 +41,9 @@ If `pyro-mcp` is already installed locally, the same server can be configured wi
 
 Profile progression:
 
-- `workspace-core`: the recommended first persistent chat profile
+- `workspace-core`: the default and recommended first persistent chat profile
 - `vm-run`: expose only `vm_run`
-- `workspace-full`: advanced 3.x compatibility surface for shells, services, snapshots, secrets, network policy, and disk tools
+- `workspace-full`: explicit advanced opt-in for shells, services, snapshots, secrets, network policy, and disk tools
 
 Primary profile for most agents: