docs: fix download banners and clarify CLI data directories

[hetaoBackend]

Change

Related to #143 and #158, in two independent commits:

• [Bug]: README banner 上的两个 Download 按钮只是图片、点击无效 / README banner's two Download buttons are painted pixels, not links #143: Make each README desktop banner link to its existing language-specific download page, preserving the image and text links. Ported the reviewed patch from Rishabh Singh (@rishabhiskawai), offered for maintainer adoption in the issue; the commit preserves his authorship. Thanks to @shuiyue-cmyk for the report.
• [Docs] Documented data dir ~/.minimax-code does not exist — actual dir is ~/.minimax #158: Correct the blanket data-directory claim across both READMEs, SECURITY.md, installation and telemetry docs. The verified public npm @minimax-ai/code@0.4.12 defaults to ~/.minimax, while this repository's source build defaults to ~/.minimax-code. Explain environment precedence, the separate installer prefix, and safe identification of the active directory. Thanks to @superbigcup325 for the report and follow-up. No runtime path changes or data migration.

Validation

• PASS: git diff --check.
• PASS: full pnpm verify on clean committed HEAD 7b970b9ac377636c3e188d4a3abfe8df74635115, macOS arm64, Node.js 26.4.0, pnpm 9.12.0. All 14 applicable gates passed. The shared classifier returns docsOnly: false because SECURITY.md is outside the docs-only allowlist.
• PASS: GitHub GFM rendering for both READMEs retains the anchor around the banner. Browser clicks on the rendered images reached the English and Chinese download pages; the images and existing text links remain intact.
• PASS: freshly downloaded npm 0.4.12 tarball matches registry SHA-512 integrity. Its exported data-directory resolver, executed with a synthetic HOME, returned ~/.minimax and respected MINIMAX_DATA_DIR before MAVIS_DATA_DIR. Freshly fetched official POSIX installer installs the npm package under its installation prefix without setting either data override.
• PASS: built source CLI telemetry status, with synthetic HOME and profiles, reports ~/.minimax-code/config.yaml by default and the expected primary/fallback override paths. The guide explicitly notes that npm 0.4.12 lacks this command.
• NOT RUN: Linux/Windows runtime acceptance, other npm release versions, installer execution, live-provider/model calls, or real-account/configuration inspection. These are documentation changes, and local macOS checks do not establish those boundaries.

Publication and contribution checks

• Permission and imported provenance are identified above; existing licenses and notices are preserved.
• No credentials, account data, real user content, internal history or private review material is included.
• Only existing file contents changed; no inventory regeneration or new test registration is needed.
• Shared English/Chinese documentation is updated. Offline checks are not described as live-service acceptance.

Maintainer handoff

Publication scope and licenses are unchanged. Shared-source port: not needed for this public documentation correction. No release, merge, issue closure, or collaborator-permission change is part of this PR.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}