docs: document extension npm dep bundling strategy

[stack72]

Summary

• Add Rule 6 to the generated CLAUDE.md template explaining that extension npm dependencies are inlined by swamp's bundler at bundle time and are not tracked in deno.lock or package.json
• Prevents AI code reviewers (pi-judge, Claude, etc.) from flagging missing lockfile entries as a reproducibility gap

Closes #617

Test Plan

• deno check passes
• deno lint passes
• deno fmt passes
• 77/77 repo_service tests pass
• deno run compile succeeds

🤖 Generated with Claude Code

[github-actions]

Adversarial Review

Critical / High

None.

Medium

None.

Low

None.

Analysis

This PR adds a single documentation line to the generateInstructionsBody() method in src/domain/repo/repo_service.ts:575. The change is a static string literal that becomes part of generated CLAUDE.md files.

I systematically attempted to break this code:

1. Logic & Correctness: No logic to break - this is a string literal. No operators, no branches, no edge cases.

2. Error Handling: No error paths involved - string concatenation in TypeScript cannot fail.

3. Security: No user input is interpolated. The backtick-escaped content (`npm:lodash-es@4.17.21`) is static documentation text, not executable code.

4. Concurrency & State: No state mutations, no async operations.

5. Data Integrity: No data transformations.

6. Resource Management: No resources acquired or released.

7. API Contract: The generateInstructionsBody() method is private. Its return type (string) is unchanged. No external callers are affected.

Verdict

PASS - This is a documentation-only change to a template string. There is no logic to break because there is no logic - just static text. The code is genuinely solid.

[github-actions]

Review Summary

This is a clean, focused documentation change that adds Rule 6 to the generated CLAUDE.md template, explaining that extension npm dependencies are bundled by swamp's bundler rather than tracked in deno.lock or package.json.

Blocking Issues

None.

Code Quality Check

• ✅ TypeScript strict mode: No issues (CI "Lint, Test, and Format Check" passed)
• ✅ No any types: Verified via grep search
• ✅ AGPLv3 copyright header: Present in file
• ✅ Named exports: No changes to export pattern
• ✅ Formatting/Linting: CI checks passed
• ✅ Tests: 77/77 repo_service tests passing (verified via CI)

DDD Review

• RepoService is correctly a Domain Service (stateless, handles repository operations)
• The generateInstructionsBody() method appropriately produces template content
• Change is a documentation addition within existing method boundaries

Security

No concerns — this is purely documentation text.

Test Coverage

Existing tests verify the structure of generated CLAUDE.md (markers, merging behavior). Specific rule content verification would be brittle for evolving documentation — current coverage is appropriate.

Suggestions

None — this is a clean change that adds useful documentation to prevent AI reviewers from flagging extension npm dependencies as a reproducibility gap.

LGTM! 🤖