docs: push fixes to main without asking

Standing authorisation from the user: a verified fix goes out in the same turn
it is finished, rather than waiting in the working tree for approval.

Written with the order fixed (verify, then commit, then push) and with the
boundary spelled out, because a push here is a deploy to every tenant at once
— entrypoint.sh runs migrate --force and db:seed on every container start, and
there is no staging. Features, schema changes and anything destructive still
get confirmed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -116,3 +116,30 @@ Dev login: `admin@oc-sport.com`
 - Verify before claiming done. Run the command, show the output.
 - Keep tool output small: `grep -o` for names, `head -c` (not `head -n`) for
   minified payloads, and never `cat` a file you only need one symbol from.
+
+## Shipping fixes — push without asking
+
+Fixes are pushed, not queued. When a bug, error, crash or regression is fixed
+and verified, commit it and `git push origin main` **in the same turn** — do
+not ask, do not stop to request approval, do not leave it sitting in the
+working tree. This is standing authorisation; asking each time is the thing it
+exists to prevent.
+
+Order is fixed and never skipped:
+
+1. **Verify.** Run the test or command and show its output. A fix that has not
+   been run does not get pushed.
+2. **Commit.** Conventional subject (`fix(scope): …`), body explaining the root
+   cause and why this fix and not another.
+3. **Push to `main`.** Then report the pushed SHA.
+
+Covers: bug fixes, crash fixes, regressions, and the tests that pin them —
+including the incidental fixes found while doing something else.
+
+Still ask first for: new features, migrations that change schema, data
+backfills, anything destructive, and any change to a live client's data.
+
+Know what a push costs here. Every client builds from `main`, and
+`docker/entrypoint.sh` runs `migrate --force` **and** `db:seed` on every
+container start. Pushing is deploying to every tenant at once, with no staging
+in between — which is exactly why step 1 is not optional.