Add Claude Code support, credential routing polish, and CYA-WP-0006

Mirror sibling-repo Claude setup (CLAUDE.md + .claude/rules/*), align
AGENTS.md with fleet credential-routing template, and close housekeeping
gaps (WP-0002-T05 done, WP-0005 status note). Draft CYA-WP-0006 for
Profile 1 production hardening as the proposed next slice.

.claude/rules/repo-boundary.md

@@ -0,0 +1,11 @@
+## Repo boundary
+
+This repo owns **can-you-assist** (`cya`) only. It does not own:
+
+- LLM provider access, API clients, or model hosting → `llm-connect`
+- Durable memory storage, profile planners, graph/event stores, or lifecycle algorithms → `phase-memory`
+- Global work tracking, decisions, or cross-repo coordination → State Hub / custodian
+- Credential custody (API keys, DB passwords, OIDC) → OpenBao / key-cape / operator paths (route via `warden route`)
+- SSH certificate issuance → `ops-warden` (`warden sign` only)
+
+`cya` integrates via stable seams (`LLMAdapter` Protocol, memory ports). State Hub is non-runtime.