fix: adopt @brainsparker/you-md, stop double-running CLI/MCP, sync versions

[brainsparker]

Why

Three things discovered while publishing and verifying the first npm release:

1. Package name. npm rejected the unscoped name you-md with E403 (too similar to the existing unrelated youmd package). The package is now published as @brainsparker/you-md, and the repo needs to match. The bin commands are unchanged: users still run you-md and you-md-mcp.
2. Every command ran twice through the published bins. dist/cli.mjs and dist/mcp.mjs end with an unconditional main() (tsup executes the entry on import), and bin/you-md.js also called main() after importing. Two concurrent inits raced: one created the profile, the other saw it exists and errored, leaving a corrupt 0-byte file. The MCP server answered every JSON-RPC request twice. Reproduced on a clean machine via npx; the wrappers now just import the entry and let it self-run.
3. Version drift. The CLI printed "you-md version 0.1.0" and the MCP server reported 0.1.0 while package.json says 0.2.0. Both now resolve the version from package.json at runtime through a shared helper (src/utils/version.ts) that walks up from the executing module, so it works in dev and in the bundle.

What changed

• package.json: name @brainsparker/you-md, publishConfig.access public (scoped packages default to private, which fails on free accounts)
• bin/you-md.js, bin/you-md-mcp.js: import the entry without calling main() again
• src/utils/version.ts (new): runtime package version resolution
• src/cli/args.ts, src/mcp/server.ts: use the shared version helper
• README.md: install commands use the scoped name (global install first, npx -p variant noted), manual MCP config args updated, library import updated, and a short package-name note under the hero

Validation

• Build clean, tsc --noEmit clean, 145/145 tests pass
• Clean-machine regression checks against the built wrappers: init runs once and writes a 1001-byte profile (previously errored with a 0-byte file), version prints 0.2.0, MCP tools/list returns exactly one response per request (previously two)

After merging

Publish 0.2.1 so npx users get the wrapper and version fixes: npm version patch && npm publish (publishConfig now carries the public access flag). The quickstart GIF in #29 has been re-rendered for the scoped install command.