document tooling discipline: make targets, shell hygiene

Add a "Tooling discipline" note to CLAUDE.md — run gates via the make
targets (e.g. make changelog-gate), not the ci/ scripts they wrap; the
Bash working dir is the repo root (no cd / git -C); one command per
invocation. Point the git-commit skill at make changelog-gate for the
60-word cap instead of naming the raw script.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -76,6 +76,15 @@ make clean           # remove build artefacts
 
 One-time setup on a fresh clone: `make hooks && flutter pub get` once Flutter is installed.
 
+### Tooling discipline
+
+The `make` targets above are the entry points — run them, not the scripts they wrap. Check the changelog with `make changelog-gate`, never `ci/changelog_gate.sh` directly; same for `analyze`/`format`/`test`/`push-check`. The `make` layer sets up the environment and stays correct if a script moves.
+
+Shell hygiene (keeps commands inside the permission allowlist, so they don't get denied mid-task):
+- **Working directory is the repo root already** — don't prepend `cd /…/clide` or pass `git -C`. Just run the command.
+- **One command per invocation** — no `&&`/`;` chaining and no multiple greps/echos in one call. The only exception is the `git commit -F` HEREDOC.
+- Prefer the Read/Edit/Grep tools over `cat`/`sed`/`grep` for inspecting files.
+
 ## Git workflow
 
 Commit and push directly to `main` for routine work — this is a solo-dev repo and does not use a branch-first / feature-branch flow. Do **not** create a working branch just to land a change. (This overrides the generic "branch before committing on the default branch" assistant default.) The usual safety rules still hold: never `--no-verify`, never force-push `main`, and let the pre-push gate run.