fix(fork): make CLAUDE.md resolve, and make its guard able to fail

CLAUDE.md

@@ -1 +1 @@
-AGENTS.md
+AGENTS.md

apps/web/src/__fork_guards__/forkWorkflowDocs.test.ts

@@ -26,9 +26,24 @@ describe("fork guard: fork-workflow-docs", () => {
   });
 
   it("keeps CLAUDE.md aliased to AGENTS.md so Claude agents get the same rules", () => {
-    const link = NodeFS.lstatSync(NodePath.join(repoRoot, "CLAUDE.md"));
-    expect(link.isSymbolicLink()).toBe(true);
-    // The committed symlink blob carries a trailing newline in its target.
-    expect(NodeFS.readlinkSync(NodePath.join(repoRoot, "CLAUDE.md")).trim()).toBe("AGENTS.md");
+    const claudePath = NodePath.join(repoRoot, "CLAUDE.md");
+    expect(NodeFS.lstatSync(claudePath).isSymbolicLink()).toBe(true);
+    // No trim. A symlink's target is its blob verbatim, so a trailing newline
+    // aims it at a filename that cannot exist — which is exactly the state
+    // this assertion used to normalize away and pass through. Upstream fixed
+    // that newline in 5e13f5357 and reintroduced it in 6891c77d3 without any
+    // guard changing value, so match the target exactly.
+    expect(NodeFS.readlinkSync(claudePath)).toBe("AGENTS.md");
+  });
+
+  it("resolves CLAUDE.md to the rules rather than merely pointing at them", () => {
+    // The promise in the manifest is that an agent opening CLAUDE.md learns
+    // the fork rules. That is a statement about what reading it produces, not
+    // about how the link is spelled, so read through it.
+    const claude = NodeFS.readFileSync(NodePath.join(repoRoot, "CLAUDE.md"), "utf8");
+    const agents = NodeFS.readFileSync(NodePath.join(repoRoot, "AGENTS.md"), "utf8");
+    expect(claude).toBe(agents);
+    expect(claude).toContain("fork:begin fork-workflow");
+    expect(claude).toContain(".fork/AGENTS.md");
   });
 });