Simplify setup and fix Bash/Zsh credential input - #21

Problem

The primary setup looked like a targets file was required for one PostgreSQL server. Its Linux/macOS credential command used Bash-only read -p, which fails in Zsh with read: -p: no coprocess.

Change

• Three first-success steps: install/register one self-contained archive, enter one connection string, then validate and launch a new client from that terminal.
• Shared Bash/Zsh hidden input with printf and IFS= read -r -s; clear stale settings and export only successful reads.
• Windows PowerShell 5.1-compatible Read-Host -AsSecureString prompt, without a PowerShell 7.1 prerequisite.
• Explain targets files as optional connection profiles. Collapse alternative installation, profiles, rc functions and technical reference outside the primary path.
• Preserve existing explicit restricted access, other MCP entries and protected files. Tell existing installations which optional section to open before switching.

No executable, package version, release artifact, registry credential or operator database was changed. Environment values remain plaintext process state; a new child client must inherit them. Existing registry publication failures are unchanged.

Observed local verification

• Exact README Bash and Zsh blocks: valid, empty, EOF and partial-without-newline input; poisoned legacy environment; explicit restricted mode; special-character credential round-trip with no captured credential output.
• Real 0.3.1 release CLI validation and MCP startup, discovery, physical database selection, read-only write refusal, same-session new-database discovery/query and shutdown, using only disposable owned PostgreSQL.
• Exact PowerShell block through Linux pwsh in a PTY, followed by the same CLI/MCP path; no captured credential output. The throwaway harness answers terminal cursor-position queries. Native Windows PowerShell 5.1 and native macOS execution were not exercised.
• Eight JSON examples parsed and 42 local documentation links/anchors resolved across README, CONTRIBUTING, SECURITY and security posture.
• Inspect the actual GitHub-rendered guide: three primary steps; optional sections collapsed by default; opening the advanced disclosure makes migration instructions visible. Explicit opening instructions avoid relying on links to expand a closed section.

Temporary verification scaffolding was removed.

Final hosted verification

Head 00d46d26bf86ac154f1dc5ca93be55fa78aec122: all 12 executed checks passed. The non-PR CodeQL analyze job was skipped by design and is not counted as a pass.

• CI and native package installation
• CodeQL baseline/candidate scans and trusted raw-SARIF gate
• SQL boundary verification
• Container security
• Dependency audit
• Secrets