chore(claude): prune what a public repo should not ship, label what stays

[koniecdev]

Why

LotroKoniecDev is public. The .claude/ tree and scripts/claude/ were built for one maintainer
and shipped to everyone who clones, with nothing explaining which parts were meant for a reader and
which were personal leftovers. This sorts that out: remove what has no value to a stranger, and put
a label on what stays.

What goes

• .claude/agent-memory/ — one maintainer's accumulated corrections. Three of the four files
  were empty "no entries yet" stubs; the only real entry described an internal loop run (M3-10: HTTPS in compose — lift TheKittySaver dev-cert setup 1:1 (working browser OIDC login in the stack) #144) and
  spawn cost that nobody outside can verify. Now gitignored: agents still read and write it
  locally, it just does not ship. CLAUDE.md's flywheel step routes anything worth keeping to a
  shared place instead — this file, an ADR, or docs/knowledge-base/.
• enabledPlugins in .claude/settings.json — shared project config was switching on two
  marketplace plugins for every clone. Which plugins a developer runs is their environment, not a
  property of this project. Moved to the gitignored settings.local.json. The dotnet build/test
  pre-allow stays, because that part really is about this repo.
• The model pin in .claude/agents/code-reviewer.md — model: claude-opus-5 + effort: high,
  stamped in from a personal model-policy.env. A public repo should not hardcode a subscription
  tier a contributor may not have. Dropping the # model-policy: review marker opts the file out
  of that stamping; model: inherit matches dat-format-expert.md. Review instructions unchanged.

What gets hardened

Claude's runtime artifacts — scheduled_tasks.json, routines/.state/, checkpoints/,
mailbox/, agent-registry.json, worktrees/, the audit lens runner — were held back only by
.git/info/exclude, which is machine-local and is not cloned. On any other machine a single
git add -A would have published maintainer runtime state to a public repository. The rules move
into .gitignore so the decision belongs to the repo rather than to one laptop.

What stays, now labelled

The loop (scripts/claude/, docs/claude-loop.md, /backlog, /work-ticket) stays. It is tested,
ADR-backed engineering and it belongs with the workflow it drives — but nothing said it was
maintainer-only, so it read as clutter.

• New scripts/claude/README.md: this needs push access, it does nothing from a fork, here is what
  a contributor wants instead — and here is why issue-trust.sh exists and why it stays on.
• Maintainer-only banner on /backlog and /work-ticket, pointing hand-driven work at /ticket.
• A short README.md section, so someone who cloned and wondered about .claude/ gets the answer
  where they are looking, plus a line for issue filers: their text passes the ADR-0026 provenance
  gate and is read by a human first.

Verification

scripts/tests/claude-loop-provenance.tests.sh — 34/34 pass. The gate itself is untouched;
the run confirms the README's description of it (fails closed, checks comment authors, argument
guard survives LOOP_TRUST_GATE=0) matches the real behaviour. No source or build files change.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AxWv8yHP7QAGFuFt2qS7q9