docs: CLAUDE.md rewrite — gotchas-only per the Claude-5 context rules (~11.5k → ~2k tokens) (#212)

* docs: CLAUDE.md rewrite — gotchas-only per the Claude-5 context rules (~11.5k → ~2k tokens)

191 lines / ~8.6k words → 57 lines / ~780 words. Keeps: the mental model +
design-of-record pointer, a narration-free layout, the command list (test
counts deleted), every load-bearing gotcha compressed to its trigger line
(with pointers to the canonical code-comment homes: users.ts KDF,
oauth-shared.ts CORS, spa-csp.ts), the shared-core/forked-runtime rule, and
the governance/CI shape. Deletes: the rc-by-rc feature changelog (drip /
plans / usage / billing / snapshots / voice / cleanup / export / semantic
essays — all re-derivable from src/ filenames + git history), the console-UX
and auth-wave histories, the environments prose, the security essays, and
all hard-coded test counts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB

* docs: reviewer must-fix — bun.lock is committed (not gitignored) + the SPA source-pin line

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XLZtmuSs1RirWGMGyCB1QB

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: unforced