docs: felhom-agent CLAUDE.md becomes a core plus path-scoped rules (R-229 leg b)

175 -> 99 effective lines. New .claude/rules/{proxmox,localapi,backup,storage}.md alongside the
existing health-checks.md. The release section points at the felhom-build-deploy skill rather than
restating a table that drifts from the script; the layout section's per-package annotations moved
into the rule file for their area instead of being deleted.

Kept in the core because it is the only part re-injected after /compact: the root-CLI fence and its
three exceptions, the destructive-op gate, prove-ownership (audit A1), the gate entry point, the F9
live-validation fence, and the checklist.

health-checks.md overlaps localapi.md and storage.md on three globs -- deliberate, both load,
stated in each file. Go build/vet/test green and unchanged.

CHANGELOG.md

@@ -1,3 +1,29 @@
+## docs — CLAUDE.md becomes a core plus path-scoped rules (2026-08-06, R-229 leg (b)) — no version bump
+
+**Documentation only. No Go changed, nothing built, nothing deployed.** `go build`/`vet`/`test` green
+and unchanged.
+
+**175 -> 99 effective lines** (207 -> 103 raw, 14,093 -> 6,267 bytes). The release/publish-train
+section was the largest block and the `felhom-build-deploy` skill already carries the procedure, so
+the core points at it instead of restating a table that drifts from the script. The package layout
+went the same way as the controller's: `REUSE.md` and the tree are its home, and the per-package
+annotations that were doing real work moved into the rule file for the area they describe rather than
+being deleted.
+
+**New:** `.claude/rules/{proxmox,localapi,backup,storage}.md`, all `paths:`-scoped, all <=46 effective
+lines, joining the existing `health-checks.md`.
+
+**Kept in the core deliberately** — it is the only part re-injected after `/compact`: the root-CLI
+fence and its three named exceptions (breaching it is how this component stops being auditable), the
+destructive-op gate, the prove-ownership rule from audit A1, the gate entry point, the F9
+live-validation fence, trunk-based with its revert-and-report escape hatch, and the end-of-session
+checklist.
+
+**Glob overlap, stated rather than silently resolved:** `health-checks.md` matches
+`internal/{localapi,guesthook}/**` and `internal/storage/**`, which `localapi.md` and `storage.md`
+also match. Both rules load in those directories and neither supersedes the other; each new file says
+so in its own text so a reader who sees two rules fire is not left guessing which wins.
+
 ## docs — the "CI is still owed" claim was stale; corrected (2026-08-06, R-229 part 2) — no version bump
 
 **One sentence, no code.** This file asserted that continuous integration was still owed