docs(readme): point the consumer instructions at devbase:2

[KaiSchwarz-cnic]

Part of RSRMID-3053 — a gap found while verifying the sweep, not part of the plan.

After 2.0.0/2.0.1 and the fleet-wide reference move, the README still told consumers to reference devbase:1. Anyone following the quick start would have landed on the old major — the one that still installs the Claude Code CLI. The sweep moved every frame and lock but not the documentation telling people what to write.

Moved to :2 — these instruct

• the quick-start feature block
• the options example (installProjectDependencies: false)
• the lock re-resolution jq recipe
• the first-publish note, made version-agnostic since it is about nothing being published at all

Also moved — these described current mechanics, and were wrong rather than merely dated

• "every rebuild re-resolves devbase:1 to the newest 1.x" now names :2/2.x, and says explicitly that this is how a minor or patch reaches a consumer, while a major changes the tag and is the deliberate step the migration section describes. That distinction was implicit before and is exactly what 2.0.0 made load-bearing.
• the Dependabot note now says "a moving major tag such as devbase:2" rather than naming :1 as though it were current.

Deliberately still naming :1

• Migrating to 2.0.0 — correct precisely because consumers did pin :1; rewriting it would destroy the instruction.
• the historical note about this repository's own lock sitting at 1.2.0 through four releases.

docs rather than a releasing type: this is the repository README, not the manifest description that ships with the artifact. That one was already corrected in #14, which is why it needed to be a fix.