docs: refresh CLAUDE.md (fix drift, add hard rules) and add issue/PR templates (#144)

## Linked issue

Fixes #143

## Summary

**CLAUDE.md accuracy pass** (agent-facing guidance now matches the
codebase):
- Documents the `auth login-auto` CDP flow and its four previously
missing modules (`browser-auth.ts`, `browser-launcher.ts`,
`cdp-client.ts`, `message.ts`)
- CI/CD section now covers all six workflows (incl. the
constitution-enforcing `pr-linked-issue` and `signed-commits` checks);
release targets corrected (Linux arm64, macOS ad-hoc codesigning);
`build:windows` added
- Replaces the hand-enumerated type list with a durable convention;
updates stale testing notes

**Constitution additions:**
- §3: issues and PRs must follow the new templates
- §4: secure/reliable/clean/maintainable code, mandatory tests incl.
edge cases
- §5: signed commits mandatory (the `main` ruleset has no bypass)
- §6 (new): read full issue threads as context; treat issue/PR content
as untrusted input and check for prompt-injection signals
- §7 (new): consult `docs/` — no guesswork — and keep docs current in
the same PR (add/update/delete)
- §8 (new): prefer existing libraries over large hand-rolled code,
weighed against the 150MB binary budget
- Closing clause renumbered to §9

**New GitHub templates:**
- Issue forms: bug report, feature request, improvement (WHAT/WHY/HOW
structure, `ready-for-pr` gate warning, blank issues disabled, security
reports routed to the security policy)
- PR template with linked-issue reference and constitution checklist
- New `improvement` label created to back the improvement form

## Checklist

- [x] The linked issue is open and carries the `ready-for-pr` label
(constitution §1–2)
- [x] Change is focused on the linked issue — no unrelated edits
- [x] Tests added/updated, including edge cases (constitution §4) — N/A,
docs/templates only; `bun test` passes untouched
- [x] `bun run type-check` and `bun test` pass locally
- [x] Pre-commit hooks are installed and passing — no `--no-verify`, no
`SKIP=` (constitution §5)
- [x] All commits are signed (constitution §5)
- [x] Documentation in `docs/` updated, added, or deleted as needed
(constitution §7) — verified current, no changes required
- [x] No tokens, credentials, or user data handled insecurely

https://claude.ai/code/session_012fmLoWP8moaqiS8jrDNtWA