docs: add CLAUDE.md for release, public-repo and live-API gotchas

[2000game]

Adds a lean CLAUDE.md that points to CONTRIBUTING.md and records what Claude sessions had to learn here. Most of it was previously kept only in local Claude memories of the main checkout, so sessions in worktrees (herdr, .claude/worktrees) never saw it. It is written to the Opus 5.5 prompting guide and the instruction-hygiene admission test.

Evidence:

• Public repo: org identifiers had to be scrubbed from code, commit bodies and the PR description of feat(apply): migrate a group's type through POST /groups/{id}/grouptype #190 (2026-09-27), and from fix(permissions)!: address group_type_role by role, not by group type (#182) #187's squash body.
• Merging is releasing: fix(x)!: produces no release under the angular preset (found while shipping v4.0.0, fix(permissions)!: address group_type_role by role, not by group type (#182) #187). Stack layers were merged one release at a time (feat(export): render managed state as OpenTofu HCL and import blocks #173/test(export): byte-stable golden snapshots over a synthetic state #174/feat(config): freeze the TypeScript DSL, point at the OpenTofu provider #176). Downstream bump ct-structure#143 was deliberately left unmerged because it applies to dev.
• Closes keyword: feat: host-portable planning, a credential helper, and tofu-aware id resolution #183 closed only A right absent from the host's catalog should warn, not hard-error — it makes a portable config unusable across instances #178 of four issues. The user caught it.
• Live API: a per-resource sweep rate-limited prod (2026-08-13). The authenticated host has switched between prod and dev between sessions. The user rejected printing the permanent token (feat(auth): ct auth token — a credential-helper interface for the OpenTofu provider #179 design discussion).

Not merged; docs-only.