refactor(docs): split CLAUDE.md into scoped rules files under .claude/rules/

Each concern (identity, session protocol, workplan convention, stack,
architecture, repo boundary) now lives in its own file with a single
responsibility. CLAUDE.md becomes a thin @-import integrator. Removes
Ralph Loop duplication — global ~/.claude/CLAUDE.md remains authoritative.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.claude/rules/repo-boundary.md

@@ -0,0 +1,6 @@
+## Repo boundary
+
+This repo owns **tunnel lifecycle management only**. It does not own:
+- State hub code → `the-custodian/state-hub/`
+- SSH key management → `railiance-infra/` (S1) or user dotfiles
+- Ansible/provisioning → `railiance-infra/`