hub: scoped auto-refresh + style.css cache-bust + staging rule (v0.48.0 parts 3-4)

- Auto-refresh: the 60s reload fires only while a live tab is active
  (nav data-live-tabs="overview,applications,events,host") AND no form is
  dirty (delegated input/change listener; never reset — a reload clears it).
  Skipped ticks reschedule; a muted (paused) hint shows next to the toggle on
  non-live tabs / dirty forms. Toggle, localStorage key, 60s cadence, and
  default-on behavior unchanged. The refresh script resolves the legacy
  settings→edit hash alias like the tabs script.
- Rider 4a: every template's stylesheet link is /style.css?v={{hubVersion}}
  (the v0.47.0 gotcha: max-age=3600 served stale styling for up to an hour
  after a deploy). Red-proof run: a reverted bare link fails the test.
- Rider 4b: CLAUDE.md standing rule — never git add -A in this repo
  (the 146d165 sweep incident); explicit paths + pull-rebase + one writing
  session per clone.
- Tests: Group C structural pins (attribute read, dirty listeners, alias x2,
  hint element, cadence/key survivors) + Group D cache-bust over six pages.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TZc5w5jDhFLv6qDC32KN5v

CLAUDE.md

@@ -77,6 +77,10 @@ pushes; **you (Claude Code) implement**. A file being open in the editor is NOT
 > **Never write secrets** into any committed file — reference them as "stored out-of-band".
 
 - Update `REUSE.md` if you added/changed/deprecated a shared helper or pattern (same commit).
+- **Never `git add -A` in this repo** — parallel sessions share the clone and it sweeps foreign
+  WIP (the v0.47.0 `146d165` incident: a red-proof-mutated guard got swept to `main`). Stage
+  explicit paths only, `git pull --rebase` before every push, and do not run two writing
+  sessions on one clone (use `git worktree` if truly needed).
 
 ## Tech stack (Hub)