feat: fold in the portable Claude Code, zsh and git config; add a drift check

Added (all now linked from their live locations):
- home_root/.claude/settings.json. The statusLine command now uses $HOME
  instead of a Linux-only absolute path.
- home_root/.claude/bin/ratecheck and home_root/.claude/skills/australis-design.
- home_config/zsh/claude-config-dir.zsh and home_root/.local/bin/claude-config-dir-init,
  the per-repo Claude Code login helper and its seeding script.
- home_root/.gitconfig and home_config/git/ignore.
- home_root/.zshenv, with the cargo env line guarded so boxes without rust start clean.

link-dotfiles --check reports drift without changing anything: tracked files whose
live copy is no longer a link (stow dry-run conflicts) and links into this repo
that dangle. Exits 1 on drift. Verified against a clean baseline and two planted
drifts, a detached .nanorc and a dangling link.

.mailmap maps every earlier identity to Vuong Hoang: the repo-local 'Your Name'
placeholder config (now removed), host-generated emails, and aider suffixes.

CLAUDE.md: the symlink warning now lists every linked file and points at --check.
README: documents what is and isn't tracked under .claude, the edit rule, and --check.

README.md

@@ -4,8 +4,8 @@ Personal dotfiles. Configs are organized by where they get linked:
 
 | Folder         | Links into   | Examples                          |
 | -------------- | ------------ | --------------------------------- |
-| `home_root`    | `~`          | `.zshrc`, `.wezterm.lua`, `.nanorc` |
-| `home_config`  | `~/.config`  | `nvim`, `zellij`, `ghostty`, `aerospace` |
+| `home_root`    | `~`          | `.zshrc`, `.zshenv`, `.gitconfig`, `.claude/`, `.local/bin/` |
+| `home_config`  | `~/.config`  | `nvim`, `zellij`, `ghostty`, `aerospace`, `zsh`, `git` |
 | `windows`      | Windows-only | `windows-terminal/settings.json`  |
 | `lk-installers`| n/a          | helper scripts to install tooling |
 
@@ -16,6 +16,7 @@ One-shot, host-aware:
 ```bash
 ./link-dotfiles          # link only (installs stow if missing)
 ./link-dotfiles --apps   # fresh box: install all CLI tools, then link
+./link-dotfiles --check  # report drift (detached copies, dangling links); changes nothing
 ```
 
 It detects the host (macOS vs Linux), installs [`stow`](https://www.gnu.org/software/stow/)
@@ -40,6 +41,31 @@ The zsh prompt and plugins (zinit, Powerlevel10k, autosuggestions,
 syntax-highlighting, completions, vi-mode, fzf-tab) **self-install** from
 `.zshrc` on first shell start, so they're not part of `install-apps`.
 
+Secrets never live here. `.zshenv` sources `~/.config/secrets/env.sh` if it
+exists; that file is per-machine and comes from the vault (`secret`), not git.
+
+## Claude Code (`home_root/.claude`)
+
+Tracked, and linked into `~/.claude`: `CLAUDE.md` (global instructions),
+`CONTEXT.md`, `settings.json`, `keybindings.json`, `statusline-command.sh`,
+`bin/ratecheck`, and the `australis-design` skill. The per-repo login helper is
+`home_config/zsh/claude-config-dir.zsh` together with
+`home_root/.local/bin/claude-config-dir-init`.
+
+Deliberately **not** tracked:
+- `.credentials.json` and `settings.local.json`, which are ignored.
+- `projects/`, the per-project auto-memory and transcripts.
+- Tool-managed skills (`graphify`, `synced`).
+- The galdrabok skill links, which galdrabok owns.
+
+**Edit the repo path, never the link with `sed -i`.** `sed -i` and other
+write-temp-then-rename editors replace the link with a detached copy, and this
+repo then silently goes stale. That happened to `CLAUDE.md` and
+`statusline-command.sh` in September 2026. Claude Code's Edit tool refuses to
+write through a link and names the target, which is the safe behaviour. Claude
+Code may also rewrite `settings.json` itself when settings change from inside the
+app. After that, or whenever in doubt, run `./link-dotfiles --check`.
+
 ## Windows (PowerShell)
 
 `stow` doesn't run natively on Windows, so use the PowerShell equivalent. It