Fix onboarding: setup.sh, build:mcp, and README quick-start commands

[scode2277]

Fixes five bugs that blocked contributors from reaching a working ✓ Connected state after a fresh clone.

• scripts/setup.sh missing pnpm install: script called tsx before node_modules/ existed; added an auto-install guard at the top
• claude mcp add outdated syntax in README: --command/--args flags don't exist in Claude Code; updated to -- <binary> <args> form with --scope user
• npx-based MCP config silently fails: Claude Code spawns stdio servers without a full shell PATH, so npx can't resolve tsx; switched README examples to use the absolute path node_modules/.bin/tsx
• build:mcp didn't build workspace dependency first: tsc couldn't resolve @security-alliance/frameworks-indexer types on a clean checkout; build:mcp now builds the indexer before the MCP app
• Unquoted $(pwd) in path-with-spaces environments: setup.sh and the "Updating Content" README commands split paths at spaces, causing ENOENT; all paths are now quoted