docs(claude): codify trunk-based no-branches rule

Expands the 'push to main; no feature branches' convention into the full rule:
report-only artifacts → felhom.eu/documentation/; risky/supervised (agent/golden/
provisioning/destructive) fixes implemented on main during the supervised session,
not prepared on a branch; unattended escape hatch = revert+report. Supersedes the old
'prepared on fix/... branch, pending review' pattern.

CLAUDE.md

@@ -78,7 +78,14 @@ Selftest modes (run from the build server, pointed at the demo API):
 
 ## Conventions
 
-- Push to `main` directly; no feature branches.
+### Trunk-based — no branches
+
+All shippable work commits **directly to `main`**; `main` is always equal to what is deployed. **Do NOT create feature/fix branches.**
+
+- **Report-only artifacts** (audits, findings, fixspecs, reconciliations) → `felhom.eu/documentation/` (`audits/`, `backlog/`), committed to `main`. Never a branch, never left loose at the repo root.
+- **Risky/supervised fixes** (agent / golden / provisioning / destructive) are spec'd, then implemented **during the supervised session itself, directly on `main`** — not prepared ahead on a branch. (This is the common case for *this* repo.)
+- **Unattended escape hatch:** if a fix can't be cleanly verified/shipped, **revert it and report it** for a supervised redo (or paste the diff into the spec doc in `documentation/`) — do not park it on a branch.
+- This supersedes any older "prepared on branch `fix/…`, pending review" pattern.
 
 > **In every repository where you make a change, update both files in that repo:**
 > - **`CHANGELOG.md`** — a cumulative log of **all** changes; newest entry on top.