docs: migrate workflow to DooPlex-local execution

CLAUDE.md

@@ -2,7 +2,7 @@
 
 > Loads when Claude Code touches this repo. Stable orientation only — **current state lives in
 > `CONTEXT.md` and the top of `CHANGELOG.md`**, never here. Cross-repo orientation: workspace-root
-> `e:\git\CLAUDE.md`.
+> `/mnt/5_hdd/felhom.eu/git/CLAUDE.md`.
 
 ## What this repo is
 
@@ -52,17 +52,24 @@ internal/storage/    storage observer + durable ids + role/claim classifiers + S
 
 - Module `gitea.dooplex.hu/admin/felhom-agent`; binary `felhom-agent` (`cmd/felhom-agent/`).
 - **Pure Go stdlib + `golang.org/x/crypto` only** — no web frameworks. `go.mod` directive go 1.25.0;
-  the build server (192.168.0.180) runs a newer upstream Go — build/run live tests there (same LAN
-  as the demo host).
+  DooPlex (192.168.0.180, where CC runs) has the Go toolchain and is on the same LAN as the demo
+  host — build and run live tests locally.
 - Version via `-ldflags "-X main.version=<v>"`; `--version` flag. Bump on meaningful changes + CHANGELOG entry.
 - **Full build/deploy/publish runbook: use the `felhom-build-deploy` skill.** Summary:
 
+> **Clean-tree gate before any build:** `git status --porcelain` must be empty and
+> `git rev-parse HEAD` must equal `git rev-parse origin/main` in the repo being built. An unpushed
+> change does not exist — never build a dirty or unpushed tree. The `git pull` in the build step
+> stays (it is a no-op when you work in this tree, and load-bearing if anything was pushed from
+> elsewhere).
+
 | Step | Where | One-liner |
 |---|---|---|
-| Build | 180 | `cd /mnt/5_hdd/felhom.eu/git/felhom-agent && git pull && go build -ldflags '-X main.version=<v>' -o /tmp/... ./cmd/felhom-agent` (felhom dirs moved off SSD → `/mnt/5_hdd/felhom.eu/` 2026-07-18) |
+| Build | DooPlex (local) | `cd /mnt/5_hdd/felhom.eu/git/felhom-agent && git pull && go build -ldflags '-X main.version=<v>' -o /tmp/felhom-agent-<v> ./cmd/felhom-agent` |
+| Copy | local → felhom-pve | `scp /tmp/felhom-agent-<v> felhom-pve:/tmp/` (one hop) |
 | Deploy | felhom-pve | backup `.bak-<old>` → `install -m0755` → `systemctl restart felhom-agent` (non-root `felhom-agent` user, config `/etc/felhom-agent/agent.json`) |
 | Ship configs | felhom-pve | sudoers (`/etc/sudoers.d/felhom-agent`) + guarded-mkfs wrapper WITH the binary when `configs/` changed |
-| Publish | local | `scripts/publish-agent.sh <ver> <bin>` (REGISTRY_* creds); hub Day-0 manifest vouch = operator follow-up |
+| Publish | DooPlex (local) | `scripts/publish-agent.sh <ver> <bin>` (REGISTRY_* creds); hub Day-0 manifest vouch = operator follow-up |
 | Verify | felhom-pve | `felhom-agent --version` + journal (clean ReassertGuestBinds, no capability degradation) |
 
 ## Proxmox model (the load-bearing rules)
@@ -81,10 +88,15 @@ internal/storage/    storage observer + durable ids + role/claim classifiers + S
 ## Demo host (for live tests)
 
 Node **`demo-felhom`**, API `https://192.168.0.162:8006`. SSH alias `felhom-pve` (root@pam) —
-available to CC; use `MSYS_NO_PATHCONV=1` for pct commands. The agent pins the served leaf cert —
-verify the fingerprint still matches before a live run. Selftest modes (run from 180, pointed at the
+available to CC as plain `ssh felhom-pve`. The agent pins the served leaf cert — verify the
+fingerprint still matches before a live run. Selftest modes (run locally on DooPlex, pointed at the
 demo API): `--selftest[=read|task|hub|storage|backup|restore-test|pbs-verify]`; no flag = the daemon.
 
+> **Legacy: Windows workstation.** Until 2026-07-19 CC ran on Windows 11; `pct` commands over SSH
+> needed `export MSYS_NO_PATHCONV=1`, and every remote command used
+> `SSH=/c/Windows/System32/OpenSSH/ssh.exe`. Agent deploy was a two-hop copy via the Windows box
+> (`cygpath -w` for the local scp path; CRLF hazard on config files).
+
 ## Conventions
 
 ### Trunk-based — no branches