docs: restructure install paths around user intent

[viniciusdc]

Part of #563.

What

Restructures the README install section around user intent instead of leading with "build from source":

• A Nebi starter workspace (recommended) - the path this epic built, where the toolchain and the config pin together.
• pixi, either into an existing project (pins in pixi.lock) or as a machine-wide CLI.
• Homebrew cask for macOS.
• Release archives, with the naming scheme spelled out and a pointer to the verification steps.
• From source, moved to a contributor-facing subsection.

### Deploy now says which invocation belongs to which install. It described a source checkout, which was correct while make build was the only documented path and wrong for five of the six paths this PR adds.

Why the commands changed since the draft

The draft documented intent. With the channel and the starters published, every command was run, and several were wrong:

• nebi import extracts into the current directory (-o defaults to "."), so the draft's cd local failed for every reader. Now passes -o local.
• pixi add has no --channel flag - the draft's form fails with unexpected argument '--channel' found. The channel goes into the manifest first, via pixi workspace channel add.
• The channel URL was the shared github-releases one. nic is on https://prefix.dev/nebari-dev/nebari. Moving to the shared channel is Move nic to the shared prefix.dev github-releases channel and delete the bridge #620.
• Homebrew ships a cask, not a formula, so brew install --cask.
• Archives are not all .tar.gz - Windows ships .zip, <os> renders darwin rather than macos, and <version> carries no leading v.
• nebi needed a floor. Below 0.10.5 the import silently produces only pixi.toml and pixi.lock - no config.yaml - so the promise next to it was false with no error. CI pins >=0.13; that is what the README now installs. (release.yml's adjacent comment claims a 0.10 floor and is itself inaccurate.)
• -c conda-forge was unnecessary. The package has no dependencies (depends: [] on every platform), and both pixi lock and pixi global install resolve against our channel alone.

Two docs corrected alongside

docs/operations/packaging.md and starters/templates/pixi.toml.tmpl both stated that the channel was empty and that the nic dependency would not resolve until the first pipeline-driven release. v0.14.0 was seeded by hand and resolves today, so with this PR telling readers to install from that channel the repo asserted both things at once. The template ships inside every generated starter, so it is the one that mattered.

How to test

pixi global install -c conda-forge "nebi-cli>=0.13"
nebi import quay.io/nebari/starters/local:v0.14.0 -o local
cd local && pixi install && pixi run nic version

And the project-scoped path:

pixi workspace channel add https://prefix.dev/nebari-dev/nebari
pixi add nebari-infrastructure-core

Both verified on linux-64 against the published v0.14.0. pixi global install was verified without -c conda-forge. The Homebrew cask was checked against .goreleaser.yml and the Casks/nic.rb in nebari-dev/homebrew-tap rather than run, since it is macOS-only.

Scope

Two items on #563 are deliberately not here, which is why this is Part of rather than Closes:

• The docs-site mirror. Two docs still say nic is distributed via the shared github-releases channel #622 tracks three remaining stale claims across two files, and the mirror makes sense alongside those rather than piecemeal.
• Links from the starter workspace READMEs to the install docs. starters/templates/README.local.md and README.aws.md still only say "Install the pinned toolchain: pixi install". Small, but it belongs with whatever next touches those templates.

Two follow-ups this PR deliberately leaves to #539, which is already editing both files and would conflict:

• .goreleaser.yml's release.header renders brew install nebari-dev/tap/nic into every release body - the formula form this PR replaces. scripts: add standalone install.sh for the nic binary #539 re-adds it, so the --cask fix belongs there.
• docs/operations/verifying-releases.md numbers integrity before signature, the reverse of the order this README makes load-bearing. scripts: add standalone install.sh for the nic binary #539 has a hunk on that exact heading.