docs(readme): swap shields.io PyPI downloads badge for the pypi-winnow-downloads endpoint

[cmeans-claude-dev]

Summary

Mirrors cmeans/mcp-synology#62. The shields.io built-in pypi/dm metric counts CI/installer/mirror traffic, which drifts from the "real users" signal as the project's own CI matrix grows. The dogfooded endpoint at pypi-badges.intfar.com winnows pip*/uv/poetry/pdm installs out of the BigQuery PyPI Linehaul dataset over the trailing 30 days.

Three deliberate changes

1. Image URL — shields.io endpoint adapter pointing at pypi-badges.intfar.com/mcp-clipboard/downloads-30d-non-ci.json (the live JSON the dogfooded service produces).
2. Link target — swapped from pypi.org/project/mcp-clipboard/ (already covered by the PyPI version badge above) to github.com/cmeans/pypi-winnow-downloads so a click on the badge surfaces the source-of-truth methodology.
3. Honesty — the displayed count is 30-day non-CI installs, not raw monthly downloads.

Endpoint pre-flight

The JSON returns:

{"schemaVersion":1,"label":"pip*/uv/poetry/pdm (30d)","message":"103","color":"blue"}

shields.io/endpoint?url=... returned HTTP 200 in pre-flight.

Closes #97.

Test plan

• Confirm the rendered badge in this PR's README preview reads sensibly (single integer, "pip*/uv/poetry/pdm (30d)" label, blue)
• Confirm the badge image link target resolves to https://github.com/cmeans/pypi-winnow-downloads
• Spot-check that no other badge in the row was disturbed
• Confirm ## [Unreleased] → ### Changed CHANGELOG entry references #97

Notes

The bogus remote branch docs/dogfood-downloads-badge (no PR, garbage content from a local branch-state mishap during cherry-pick) is left in origin for now — force-push is blocked by sandbox policy. I can request authorization to delete it, or you can drop it via git push origin --delete docs/dogfood-downloads-badge. Either is safe; nothing references it.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[cmeans]

LGTM

[cmeans]

QA Review — Round 1

Head 2034da3. 2 files / +11/-1: README.md (1 line: Downloads badge URL + link target swap) and CHANGELOG.md (10-line entry under ### Changed, "Closes #97"). Mirrors cmeans/mcp-synology#62 (merged 2026-04-26).

Live verification

Check	Result
Endpoint JSON pypi-badges.intfar.com/mcp-clipboard/downloads-30d-non-ci.json	✅ HTTP 200, returns shields.io-compatible payload: {"schemaVersion":1,"label":"pip*/uv/poetry/pdm (30d)","message":"106","color":"blue"} (PR body cited 103 — drift from elapsed time, not a discrepancy)
shields.io endpoint adapter render img.shields.io/endpoint?url=...	✅ HTTP 200, image/svg+xml 1164 B, SVG aria-label="pip*/uv/poetry/pdm (30d): 106"
Badge link target github.com/cmeans/pypi-winnow-downloads	✅ HTTP 200 (curl HEAD)
URL-encoding of the embedded shields.io endpoint URL	✅ correct: https%3A%2F%2F decodes to https://, path components correctly percent-encoded
Issue #97 scope (Closes #97)	✅ all three deliberate changes from the issue are present in the diff: image URL → endpoint adapter, link target → pypi-winnow-downloads, CHANGELOG honesty re "non-CI installs"
Repo-wide grep for stale pypi/dm references	✅ none remain (only mention is in the CHANGELOG describing the swap)
Other badges in the README row undisturbed	✅ diff confirms only line 16 changed; License/CI/Coverage/Glama unchanged
Sibling-PR parity vs cmeans/mcp-synology#62	✅ same two-file shape (CHANGELOG.md + README.md), same three-deliberate-changes structure

Verification (current session)

Check	Result
uv run pytest -q	488 passed, 6 deselected, 5 xfailed
uv run ruff check src/ tests/	clean
uv run mypy src/	clean
CI rollup on 2034da3	lint / typecheck / test 3.11–3.13 / on-push / qa-approved / codecov-patch / Dependabot CHANGELOG (correctly SKIPPED — non-Dependabot PR) all SUCCESS

Test plan

All four items pre-merge testable; all four verified above and ticked in the PR body:

• ✅ Rendered badge — single integer "106", pip*/uv/poetry/pdm (30d) label, blue
• ✅ Badge link target resolves to github.com/cmeans/pypi-winnow-downloads
• ✅ No other badge disturbed
• ✅ CHANGELOG entry references #97

Verdict

Ready for QA Signoff. Zero findings. The "stray docs/dogfood-downloads-badge branch on origin" mentioned in the PR Notes is housekeeping outside this PR's scope — happy to surface a one-liner instruction when you're ready to drop it (git push origin --delete docs/dogfood-downloads-badge), but it's not a QA blocker. Awaiting maintainer QA Approved.

[cmeans]

Applying Ready for QA Signoff as the final act of round 1: zero findings, all four test-plan items pre-merge verified and ticked in the PR body, live endpoint + shields.io adapter + link target all return HTTP 200, sibling parity with mcp-synology#62 confirmed, no stale pypi/dm references remain after repo-wide grep. Verification clean (pytest 488, ruff/mypy, all CI green on 2034da3). Awaiting maintainer QA Approved.