docs: qualify the workspace decision references

D-26 and D-27 are workspace decisions, and this repo's own vault has none, so
a bare citation here means nothing resolvable — workspace D-21 requires the
vault to be named. Found by `make verify` in the workspace, which is the case
that rule was written for.

Co-Authored-By: Claude <noreply@anthropic.com>

CLAUDE.md

@@ -92,7 +92,7 @@ intelligence belongs in the gateway or in Tatlock itself.
 **One Makefile at the root drives all three components.** There is deliberately no
 `gateway/Makefile` any more — `make test` meant "the gateway's tests" or "nothing"
 depending on which directory you were standing in, and now it means the same thing
-everywhere (D-27).
+everywhere (workspace D-27).
 
 ```bash
 make help                          # every target, self-documenting
@@ -117,7 +117,7 @@ misses on this host. Override with `IDF_EXPORT=<path>/export.sh` on another mach
 the target fails loudly with that hint if the file is absent.
 
 `make test` never reports green for the firmware. It has no suite, so it is
-**undetermined**, printed explicitly rather than skipped silently (D-26).
+**undetermined**, printed explicitly rather than skipped silently (workspace D-26).
 
 ## Liveness