Set up the workspace on the first run when npm blocked the install script

[beharguy]

Why

Recent npm versions do not run a package's install scripts until the user approves them (npm warn install-scripts … not yet covered by allowScripts). On such a machine a fresh npm i -D @uidxkit/uidx succeeds, but the postinstall never runs: no .uidx/, no uidx / uidx:mcp scripts, no .mcp.json entry, no skills. The documented next step, npm run uidx, does not exist, and npx uidx dev stopped with "No uidx workspace found". Reported from a Windows machine on 0.1.5.

What changes

• uidx dev (and uidx open on a directory) inside an npm project with no workspace now runs the same initProject setup the postinstall performs, then serves, and prints what it added. OpenResult.initialized carries the project root so the CLI can say so.
• A directory with no package.json above it still gets the uidx init hint, and a setup failure (for example a taken script name) is reported with the --script advice.
• READMEs explain npm's approval prompt, the npm install-scripts approve @uidxkit/uidx alternative, and that the first run sets things up; changelog entry under Unreleased.

Verification

• New tests in open.test.ts: first run sets up a fresh npm project (manifest, welcome page, scripts) and serves; a non-project directory is refused; an existing workspace reports initialized: null. The init.test.ts expectation for the missing-workspace message moved to the non-project case.
• CLI suite passes (122 tests), type check, ESLint and Prettier clean.
• Packed tarball installed with --ignore-scripts (what a blocked postinstall looks like), then npx uidx dev --no-open: the workspace, scripts and skills are created and the server starts.

🤖 Generated with Claude Code