docs: R-168 is CLOSED — the "CI is still owed" sentence was stale (R-229 part 2)

Corrected in all four instruction files across all four repos. Found while confirming this
session own push by run ID, which is precisely the check that catches it.

In felhom-agent/CLAUDE.md the sentence contradicted the same file release section, which
already said R-168 mails the failure -- a contradiction inside one instruction file, the exact
class the R-229 work exists to find.

REPORT.md deliberately NOT overwritten in the sibling repos: a one-line docs correction must not
destroy the record of their last real implementation.

CLAUDE.md

@@ -45,7 +45,8 @@ deployed `app.yaml` (customer secrets) is never overwritten. Full deploy details
   runtime and take minutes per app, and a push that pulls images and starts containers gets bypassed
   within a week, after which the bypass is the habit. They stay deliberate periodic runs. The hook is
   per-clone (`git config core.hooksPath .githooks`) and `git push --no-verify` bypasses it, which is
-  why R-161's automatic half is still owed — it is now tracked as `felhom.eu` `OPEN-ITEMS.md` R-168.
+  why gate 1 alone cannot be the whole story — CI re-runs the entry point on every push and **emails
+  on failure** (`felhom.eu` `OPEN-ITEMS.md` R-168, CLOSED 2026-08-02), which is what notices a bypass.
 - **Never `:latest` or untagged images in templates** — pin a concrete version tag; an app deployed
   anywhere in the fleet is pinned to the digest it is currently running (a pin must never cause a
   version jump). Digest pins (`@sha256:`) also count. Gate: `python scripts/check-image-pins.py`