docs: point npm and GitHub CTAs at the tracked MCP landing page

[escott-]

Summary

Organic package and repo traffic currently lands on /docs/mcp (npm "Homepage") or /signup (README web link), and neither tells you which directory the visitor came from. This PR points both at the tracked MCP landing page:

• package.json homepage (npm sidebar "Homepage"):
  https://contextstream.io/lp/mcp-marketplace?utm_source=npm&utm_medium=directory&utm_campaign=mcp_organic_2026q3&utm_content=card_cta
• README "Prefer to start on the web?" (the primary web CTA under Start free with MCP): same landing page with utm_source=github.
• README hosted endpoint: https://mcp.contextstream.io/mcp?default_context_mode=fast. This matches the URL the website uses in every editor snippet and in llms.txt.

Unchanged on purpose:

• The install one-liner already uses https://contextstream.io/scripts/mcp.sh. The bash -o pipefail -c wrapper stays because the README explains it.
• server.json is left alone. v1.0.9 is already published to the MCP Registry, and the release job verifies registry metadata is identical for an existing version. Any websiteUrl / remotes change should ship with the next version bump.
• The Rust setup default (DEFAULT_REMOTE_MCP_URL) is not touched.

The public-boundary impact is limited to URLs. There is no code or wire change.

Note: npm shows the README and homepage from the published tarball, so both update on the next npm publish. The README renders on npm as well as GitHub, so web-CTA clicks from npmjs.com will be attributed to utm_source=github. The npm-specific signal is the homepage link.

This does not re-merge the earlier keyword/metadata PRs.

Validation

• cargo fmt --all --check: n/a, no Rust changes
• cargo clippy --locked --workspace --all-targets -- -D warnings: n/a, no Rust changes
• cargo test --locked --workspace --all-targets: n/a, no Rust changes
• npm test: 6/6 pass
• python3 .github/scripts/public_boundary.py .: "Public boundary verified for v1.0.9."

Data handling and compatibility

• The change does not add credentials, customer data, raw local paths, or private deployment topology.
• No new collection or transmission of user data. The UTM parameters are on outbound website links only.
• Existing npm executable aliases and MCP wire compatibility are preserved.

Contribution certification

• Every commit includes a Signed-off-by: trailer (git commit -s). Verified locally with .github/scripts/dco_check.py.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Wir2srSU9SBEts3nGDT7wC

---

Generated by Claude Code

[escott-]

Review: approve to merge (squash).

• The diff is docs and metadata only: the README web CTA, the README hosted endpoint (?default_context_mode=fast, matching what setup writes) and package.json homepage.
• The landing page https://contextstream.io/lp/mcp-marketplace returns HTTP 200.
• Checked on ovh-desktop against main (c3e8029) plus this PR:
  • fmt, clippy -D warnings and cargo test --locked --workspace all pass
  • public_boundary.py passes
  • test_public_boundary, test_release_contract, test_workflows and test_dco_check all pass
  • npm test passes 6/6
• As the description says, this goes out with the next npm publish (1.0.10).

🤖 Generated with Claude Code