docs: pin the branch and ref checks into the push rule

Standing authorisation to push fixes without asking was already in place; what
was missing were the checks that make it safe to exercise.

Both failed today. The session-start git snapshot said `main` while a parallel
session had since checked out a feature branch in the same working copy, so a
verified fix was committed to the wrong branch — and `git push origin main`
then reported "Everything up-to-date" and exited 0 while the fix sat elsewhere.
A no-op push is indistinguishable from a successful one unless the remote ref
is checked.

Also makes explicit-path commits mandatory. This checkout is shared with other
sessions whose in-flight work can be staged in the index; `-a` or `git add -A`
would sweep it into a fix commit and deploy it to every tenant.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -129,9 +129,23 @@ Order is fixed and never skipped:
 
 1. **Verify.** Run the test or command and show its output. A fix that has not
    been run does not get pushed.
-2. **Commit.** Conventional subject (`fix(scope): …`), body explaining the root
-   cause and why this fix and not another.
-3. **Push to `main`.** Then report the pushed SHA.
+2. **Check where you are.** `git rev-parse --abbrev-ref HEAD` and `git status`,
+   read fresh — never the git snapshot from the top of the session. Another
+   session may have switched branches or staged work in this same checkout
+   since then.
+3. **Commit by explicit path.** `git commit <paths> -m …` naming only the files
+   of this fix. Never `-a`, never `git add -A`, never a bare `git commit` that
+   sweeps whatever is already in the index. Conventional subject
+   (`fix(scope): …`), body explaining the root cause and why this fix and not
+   another.
+4. **Push to `main`.** Then prove the ref moved — `git rev-parse origin/main`
+   must equal the new commit. `git push` prints "Everything up-to-date" and
+   exits 0 when it pushed nothing at all, so a clean exit is not evidence.
+   Report the SHA only after the ref check.
+
+Committing from a branch that is not `main` is not a failure as long as `main`
+is fast-forwarded to the commit and that is what gets pushed — but it has to be
+noticed, which is what step 2 is for.
 
 Covers: bug fixes, crash fixes, regressions, and the tests that pin them —
 including the incidental fixes found while doing something else.