docs: fix pipefy-login AUTH_URL note and document local-checkout plugin testing

[mocha06]

What

Two documentation changes.

1. /pipefy:pipefy-login command — drop the false PIPEFY_AUTH_URL requirement

commands/pipefy-login.md claimed PIPEFY_AUTH_URL must be set in the shell. It isn't required — it defaults to the prod OIDC issuer (https://signin.pipefy.com/realms/pipefy). Only non-prod IdPs need it. Reworded to say so.

2. Document testing the plugin from a local checkout

Adds a README section on pointing the plugin marketplace at a local clone (so a working branch loads live), including the /reload-plugins step and the extraKnownMarketplaces lock gotcha. Linked from CONTRIBUTING's skill quick-start so contributors can try skills before opening a PR.

Dropped from this PR

An earlier revision also rewrote the macOS keychain troubleshooting entry in docs/cli/auth.md. That's been removed — #265 already owns that section (with CLI code, and closes #235), so the keychain guidance is deferred there to avoid a competing narrative. See the review thread for the -25244 constant details.

Scope

Docs and command text only. No code or behavior changes.

[adriannoes]

Summary

Static review of the docs-only changes (checkout not required; CI lint/test are green). The PIPEFY_AUTH_URL fix in commands/pipefy-login.md matches the prod default in code. The keychain troubleshooting rewrite in docs/cli/auth.md needs a correction before merge: it equates -25244 with missing Security.framework entitlements, which does not match Apple's SecBase mapping.

What worked well

• Dropping the false PIPEFY_AUTH_URL requirement and documenting the prod issuer default.
• Replacing "is rare" with concrete remediations (PIPEFY_KEYCHAIN_BACKEND=file, system/Homebrew Python).
• The local Claude Code marketplace checkout section is useful for contributors.

Required before merge

• F1: Rewrite the macOS keychain sentence so -25244 is not described as missing entitlements (see inline).

Also noted

• Open PR #265 edits the same troubleshooting section with a different narrative; reconcile when the second of these lands. Updating packages/mcp/README.md can stay with that follow-up.

Verification

• Confirm DEFAULT_AUTH_URL remains https://signin.pipefy.com/realms/pipefy.
• Confirm the auth.md paragraph no longer ties -25244 to missing entitlements.

[adriannoes]

Summary

Re-checked the latest head (b586c6ed). The contested docs/cli/auth.md keychain rewrite is gone, so F1 is addressed by dropping that hunk and deferring the narrative to #265. What remains is the accurate PIPEFY_AUTH_URL default note in commands/pipefy-login.md plus the local Claude Code marketplace checkout docs.

What worked well

• Confirming the SecBase mapping in-thread and choosing handoff to #265 instead of shipping a competing keychain story.
• Keeping the AUTH_URL fix and the contributor local-checkout guidance.

Verification

• Diff no longer touches docs/cli/auth.md.
• CI lint/test green on the current head.