docs: clarify published-artifact install path across README and onboarding

Make it explicit that partners do not need to clone the repo to install
Koshi. The canonical path is the published OCI Helm chart and container
image; the local demo is scoped to development/validation only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: kernel-gd

README.md

@@ -4,6 +4,8 @@ Koshi Runtime is a workload-scoped governance plane for AI systems. It deploys a
 
 **Discover your governance posture before enforcing it.** Koshi ships in **listener mode** by default: the full enforcement pipeline — identity resolution, policy lookup, guard evaluation, budget accounting — executes on every request, but no traffic is blocked. Shadow decisions (`would_reject`, `would_throttle`, `would_kill`) reveal exactly where your policies would intervene. When the posture matches your intent, enabling enforcement is a config change — same binary, same pipeline, same metrics.
 
+**No repo clone required.** Install Koshi directly from the published OCI Helm chart and container image.
+
 ## Quick Start: Kubernetes (Listener Mode)
 
 ```bash
@@ -28,7 +30,7 @@ curl http://localhost:15080/metrics | grep koshi_listener
 
 ### What You Can Do on Day One
 
-- Install Koshi in listener mode — one Helm command, no config files required
+- Install Koshi in listener mode — one Helm command, no repo clone or config files required
 - Label any namespace and restart workloads to get sidecars injected
 - Collect structured JSON events from `koshi-listener` container logs
 - Scrape Prometheus metrics from `/metrics` on port `15080`

demo/local/README.md

@@ -2,7 +2,7 @@
 
 This demo creates a local Kubernetes cluster with kind, installs Koshi in listener mode, deploys a mock upstream and sample workload, sends synthetic traffic, and validates structured events and metrics.
 
-> **For partner onboarding on a real cluster**, see [Koshi Onboarding](../../docs/onboarding.md). This demo is for local development and validation only.
+> **This demo is for local development and validation only.** It requires a repo checkout, a local Docker build, and a kind cluster. To install Koshi on a real cluster using published artifacts, see [Koshi Onboarding](../../docs/onboarding.md).
 
 ## Prerequisites
 

docs/onboarding.md

@@ -2,6 +2,8 @@
 
 This guide walks through installing Koshi in listener mode, verifying the sidecar is active, collecting governance signal, and interpreting shadow outcomes — all without blocking any traffic.
 
+This flow uses published release artifacts. No local repo checkout is required.
+
 ## Install
 
 ```bash
@@ -16,6 +18,8 @@ kubectl label namespace <namespace> runtime.getkoshi.ai/inject=true
 kubectl rollout restart deployment -n <namespace>
 ```
 
+> The default image is `ghcr.io/koshihq/koshi-runtime`. To use the Docker Hub mirror, add `--set image.repository=docker.io/koshihq/koshi-runtime`.
+
 ## Verify
 
 **Confirm the sidecar is injected:**