Add Claude Code support, credential routing polish, and CYA-WP-0006

Mirror sibling-repo Claude setup (CLAUDE.md + .claude/rules/*), align
AGENTS.md with fleet credential-routing template, and close housekeeping
gaps (WP-0002-T05 done, WP-0005 status note). Draft CYA-WP-0006 for
Profile 1 production hardening as the proposed next slice.

.claude/rules/first-session.md

@@ -0,0 +1,37 @@
+## First Session Protocol
+
+Triggered when `get_domain_summary("capabilities")` shows **no workstreams**.
+The project is registered but work has not yet been structured.
+
+**Step 1 — Read, don't write**
+- `INTENT.md`, `README.md`, `SCOPE.md`, `AGENTS.md`, `MemoryVision.md`
+- Scan repo root: `src/cya/`, `workplans/`, `tests/`
+
+**Step 2 — Survey in-progress work**
+Look for TODOs, open branches, half-finished files. Note done vs. started but incomplete.
+
+**Step 3 — Propose workstreams to Bernd**
+Propose 1–3 workstreams — each a coherent strand, weeks to months, anchored to
+INTENT/SCOPE. **Wait for approval before creating.**
+
+**Step 4 — Create workplan file first, then DB record (ADR-001)**
+```
+workplans/CYA-WP-NNNN-<slug>.md   ← write this first
+```
+Then register in the hub:
+```
+create_workstream(topic_id="64418556-3206-457a-ba29-6884b5b12cf3", title="...", owner="...", description="...")
+create_task(workstream_id="<id>", title="...", priority="high|medium|low")
+```
+
+**Step 5 — Record the setup**
+```
+add_progress_event(
+    summary="First session: structured capabilities/can-you-assist into N workstreams, M tasks",
+    event_type="milestone",
+    topic_id="64418556-3206-457a-ba29-6884b5b12cf3",
+    detail={"workstreams": [...], "tasks_created": M}
+)
+```
+
+<!-- Past first session for this repo — retained for fleet consistency -->