docs: update BUILDING.md and INDEX.md to reflect toolchain changes

BUILDING.md:
- Add --no-scripts to manual 'composer install' command
  (prevents kcode init from running during install before binary exists)
- Update Version Bumping section: Makefile now resolves VERSION via
  'git describe --tags' first, falling back to box.json → 'dev'

INDEX.md:
- Add Code Quality workflow to Quick Navigation
  (code-quality.yml: security + phpstan + cs-fixer via kcode)
- Update CI workflow description: 'Tests + PHAR build on push/PR'

Author: walmir-silva

docs/BUILDING.md

@@ -65,8 +65,8 @@ make self-test    # Run against this project
 ### Manual Build
 
 ```bash
-# 1. Install dependencies (with dev for quality tools inside PHAR)
-composer install --no-interaction --prefer-dist --optimize-autoloader
+# 1. Install dependencies (with dev — quality tools are bundled in the PHAR)
+composer install --no-interaction --prefer-dist --optimize-autoloader --no-scripts
 
 # 2. Compile PHAR
 php -d phar.readonly=0 box compile --config=box.json
@@ -221,4 +221,4 @@ The version is stored in two places — keep them in sync:
 1. `src/Core/Devkit.php` → `private const string VERSION = '1.0.0';`
 2. `box.json` → `metadata.version`
 
-The Makefile reads the version from `box.json` for build output messaging.
+The Makefile resolves the version via `git describe --tags --abbrev=0` first, falling back to `box.json` metadata, then `'dev'`. Always tag releases with `git tag vX.Y.Z` before running `make release`.

docs/INDEX.md

@@ -27,5 +27,6 @@
 - [composer.json](../composer.json) — Package definition
 - [box.json](../box.json) — PHAR compilation configuration
 - [Makefile](../Makefile) — Build automation targets
-- [CI workflow](../.github/workflows/ci.yml) — Quality checks on push/PR
+- [CI workflow](../.github/workflows/ci.yml) — Tests + PHAR build on push/PR
+- [Code Quality workflow](../.github/workflows/code-quality.yml) — Security, PHPStan, CS-Fixer via kcode
 - [Release workflow](../.github/workflows/release.yml) — PHAR build on tag push