Add Claude Code support, credential routing polish, and CYA-WP-0006

Mirror sibling-repo Claude setup (CLAUDE.md + .claude/rules/*), align
AGENTS.md with fleet credential-routing template, and close housekeeping
gaps (WP-0002-T05 done, WP-0005 status note). Draft CYA-WP-0006 for
Profile 1 production hardening as the proposed next slice.

.claude/rules/agents.md

@@ -0,0 +1,32 @@
+## Agent entry points
+
+| Runtime | Canonical instructions |
+| --- | --- |
+| **Grok / Codex** (shell) | `AGENTS.md` at repo root |
+| **Claude Code** | This file tree via `CLAUDE.md` |
+
+`AGENTS.md` and `.claude/rules/` are kept in sync for repo-specific content.
+Fleet-wide credential routing is mirrored in `credential-routing.md` and the
+matching section of `AGENTS.md` — re-sync from `~/ops-warden/wiki/CredentialRouting.md`
+when the catalog changes.
+
+## Kaizen Agents
+
+Specialized agent personas available on demand via the state-hub MCP.
+
+**Discover:** `list_kaizen_agents()` — returns all agents with name, description, category
+**Load:** `get_kaizen_agent("tdd-workflow")` — returns full instructions; read and follow them
+
+Common agents:
+
+| Agent | Category | When to use |
+|-------|----------|-------------|
+| `tdd-workflow` | testing | Step-by-step TDD8 workflow for any feature |
+| `code-refactoring` | quality | Code quality analysis and safe refactoring |
+| `test-maintenance` | testing | Diagnose and fix failing tests |
+| `requirements-engineering` | process | Prevent interface/mock mismatches upfront |
+| `keepaTodofile` | process | Maintain TODO.md during work |
+| `project-management` | process | Track status, determine next steps |
+| `datamodel-optimization` | quality | Optimize dataclasses and data structures |
+
+All 17 agents: call `list_kaizen_agents()` for the full list.