[Repository Standards] Align CLAUDE.md and .claude allowlist with real Makefile targets

[jentic-harness]

Human decisions required

1. Remove the explicit h2>=4.1.0 runtime dependency? — h2 is declared in pyproject.toml (line 33) but never imported directly anywhere in the codebase. It is HTTP/2 support that uvicorn[standard] already pulls in transitively, so the explicit pin may be a deliberate security floor (forcing a minimum patched version) rather than dead weight. I did not remove it because that judgement — "is this an intentional transitive-version pin or a redundant line?" — needs a human who knows the security-pin policy. Options: (A) leave it, (B) remove it and rely on uvicorn[standard], (C) keep it but add a comment explaining it's a security floor.
2. Deduplicate the broker proxy Operation ID? — the arch/OpenAPI tests emit UserWarning: Duplicate Operation ID proxy because the single catch-all proxy route in broker/web/routers/execute.py:846 serves seven HTTP methods under one function name. Suppressing the warning (e.g. per-method operation_ids) would change the committed broker OpenAPI artifact and the generated spec, which is a product-facing API-contract decision, not a janitorial one. Left untouched.
3. Bump react-router past the CSRF advisory (unrelated to this PR)? — CI's Security scan (Trivy) fails on a pre-existing HIGH finding, GHSA-qwww-vcr4-c8h2 (React Router RSC-mode CSRF bypass), in ui/package-lock.json at react-router@7.18.1. This finding is already present on main and this PR touches no UI/dependency files, so the failure is not introduced here. The fix requires a major 7→8 bump of react-router-dom (ui/package.json pins ^7.18.1), a breaking change well outside a docs/config cleanup — deferred to a human or dependabot. Options: (A) let dependabot handle the major bump, (B) a maintainer bumps react-router-dom to ^8.3.0 and adjusts breaking API usage, (C) add a Trivy .trivyignore/VEX entry if the RSC-mode path is not exploitable here.

To act on these: add a PR comment that starts with /ai-implement listing
the decision numbers you want complete (e.g. /ai-implement implement 1 and 3 option A).

Changes

1. Rewrote the Commands table in CLAUDE.md to match the actual Makefile — the table listed a phantom make fmt target (the real target is fix), described check as running "unit + arch tests" when it actually runs lint score detect-secrets test-arch (no unit tests), and omitted ~17 user-facing targets (openapi, endpoints, dev, start-broker, the sqlite and ui-* targets, cli-reference, broker-reference, etc.). Also corrected stale descriptions for install, sync, test, start-fixtures, and cov. Verified against grep -nE '^[a-z...]+:.*## ' Makefile.
2. Fixed the permission allowlist in .claude/settings.json — it allowed Bash(make fmt) and Bash(make pre-commit), neither of which is a real Makefile target. Corrected to make fix and make hooks respectively, so the allowlist actually matches runnable commands.
3. Recorded the docs-vs-Makefile drift check in the job steering file (.harness/GARBAGE_COL_STANDARDS.md) so future runs can re-verify command references against the ground-truth Makefile.

Configuration: https://harness.jentica.jentic.io/repos/jentic/jentic-one

[jentic-harness]

[Orchestrator] Scheduled run for job-repo-standards skipped — this PR from the previous run is still open.

[jentic-harness]

[RepoStandardsAgent] CI Security scan (Trivy) is failing, but not because of this PR.

• Finding: GHSA-qwww-vcr4-c8h2 (HIGH) — React Router RSC-mode CSRF bypass — in ui/package-lock.json at react-router@7.18.1.
• Pre-existing on main: main pins the same react-router@7.18.1 (via react-router-dom: ^7.18.1 in ui/package.json). This PR changes only CLAUDE.md, .claude/settings.json, and .harness/GARBAGE_COL_STANDARDS.md — no UI or dependency files — so it cannot introduce or resolve this finding.
• Why I didn't fix it: the advisory's fixed version is 8.3.0, i.e. a major 7→8 bump of react-router-dom. That's a breaking change requiring API migration and UI test updates — out of scope for a docs/config cleanup and a genuine human/dependabot call. Making that bump as a drive-by "targeted fix" would risk the UI. It's recorded as decision feat: OAuth Broker management UI #3 in the PR body.
• This PR's own relevant checks pass: Detect changes ✅ and Lint & type-check ✅. The remaining jobs (Unit/Integration/UI/CLI) were skipped by path filters because no code paths changed.

Flagging needs-human for the dependency decision. Everything this PR actually changes is green.