docs: fix an inaccurate install section, and separate the two installs

[duncancrawford]

Left behind when #27 merged — pushed while that merge was in flight, so main
took the plugin-manifest fix without these README corrections. Same
stranded-commit pattern CLAUDE.md records; this is the fourth time.

The feed is not private

The section said releases were reachable only "Inside HMCTS", told everyone else
to install from source, and required keyring/artifacts-keyring plus a
device-flow sign-in. None of that is true.

Verified: pip download with a clean HOME, no ~/.netrc and no keyring
resolves and fetches the 0.5.1 wheel (77,012 bytes, valid zip). The feed root
does return 401, which is what makes it look private, but pip requests the
per-package path — that serves the full distribution listing and the artefacts
unauthenticated. Credentials are needed only to publish, which is the release
workflow's job.

The practical cost of the old text: anyone outside HMCTS was told to install
unreleased main from source instead of a pinned release, and anyone inside was
sent to set up credentials they never needed.

The Quickstart taught the trap this library warns about

Its example filter put a trailing comment on a team rule. A rule's value is
the whole rest of the line, so it parsed as:

'my-github-team          # or: everything a GitHub team owns'

— a slug matching no team, contributing nothing, silently. That is the same
failure that dropped three repositories from the crime estate and became issue
#20. The comment moves to its own line, the rule is stated, and the warning that
now catches it (discover, and --strict for CI) is pointed out.

Two installs, not one

A pip install from an Azure feed and a plugin install from a GitHub clone were
documented 200 lines apart with nothing saying they are unrelated, so they read
as steps in one flow. There is now a table naming both — what each gives you,
where it comes from, who needs it — with the two ## Install: headings renamed
into a matching pair and cross-linked.

It also states the asymmetry that surprises people: a release does not ship a
skill change, and a skill change needs no release, so a store can pin library
v0.5.1 while running skills from a later main.

Stale numbers dropped

The estate size (93 repositories, 745k nodes), the test count (110, actually
232) and the pinned example version (==0.5.0, released 0.5.1) — all of which
rot on their own schedule.

Note on ordering

hmcts/cp-knowledge-store#30 deep-links to #install-the-claude-code-plugin,
which exists only once this merges.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud