docs(claude): stop the daily maintenance PR pileup

[bryanfawcett]

Summary

The scheduled "keep the repo up to date" routine had been opening a new draft PR every day for the past 8 days (#30, #31, #33, #34, #35, #36, #37, #39) without checking for existing open PRs or ever merging its own work, and repeatedly hand-resolved actions/checkout SHA drift in inconsistent directions (flip-flopping between two SHAs) instead of deferring to Dependabot. This adds explicit rules to CLAUDE.md for scheduled/unattended sessions: dedupe against open PRs from the same routine before opening a new one, leave third-party Action version pins to Dependabot (which already owns that job weekly), run formatters before committing, and merge routine/mechanical fixes once required checks are green instead of leaving them open indefinitely.

Linked issue(s)

Closes #

Type of change

• docs — documentation only

Breaking change?

• This PR introduces a breaking change.

How has this been tested?

Ran prettier --check and markdownlint-cli2 locally against the changed file; both pass. This is a documentation-only change with no runtime surface to exercise.

Checklist

Process

• My PR title follows Conventional Commits.
• All of my commits are signed (SSH) and show "Verified" on GitHub.
• All of my commits have a DCO sign-off (Signed-off-by: trailer, added by git commit -s).
• My branch name follows claude/<short-kebab-description>.
• I have rebased onto the latest default branch; no merge commits from the base branch in this PR.
• I have added or updated tests covering the change — N/A, documentation only.
• I have updated documentation where relevant (this PR is the documentation update).
• I ran the repo's local checks (prettier, markdownlint) and they pass.
• Any new runtime dependencies are justified in this PR description — N/A, none added.
• If this is a breaking change... — N/A.

NA-03 merge blockers

• N/A — this change does not touch schema, APIs, dependencies, cryptography, data placement, or smart-contract counts.

Additional notes

Companion cleanup done in this session (not part of this diff):

• Merged Dependabot's build(deps): bump the all group with 5 updates #38, which correctly fixed the real actions/checkout SHA inconsistency that all 8 stale PRs were chasing.
• Closed fix(governance): align docs and CI with NA-03 v1.6 and org-wide consistency #30, ci: align SHA pins, add pnpm audit, and add change detection to TypeScript CIs #31, ci: align terraform checkout SHA, add pnpm audit to TS CI, fix PR template and ORG_SETTINGS #33, docs(ci): document missing workflows, fix SHA drift and allow-list gaps #34, ci: pin all actions/checkout to v6.0.3, fix stale SHAs, document missing workflows #35, ci: sync action SHA pins and document new reusable workflows #36, docs(ci): update governance docs and deprecate legacy workflows #37, ci: add pnpm audit gates, fix SHA drift, update docs to match NA-03 v1.6 #39 as superseded, with comments noting which of them contained genuinely reusable ideas (a shell-injection guard on build-command in reusable-ci-docs-mdx.yml from docs(ci): update governance docs and deprecate legacy workflows #37, pnpm audit gates from ci: align terraform checkout SHA, add pnpm audit to TS CI, fix PR template and ORG_SETTINGS #33/ci: add pnpm audit gates, fix SHA drift, update docs to match NA-03 v1.6 #39, deprecation banners from docs(ci): document missing workflows, fix SHA drift and allow-list gaps #34) worth resubmitting individually rather than being silently dropped.

---

Generated by Claude Code