Make CLAUDE.md public; split to CLAUDE.local.md

[WilfordGrimley]

Summary

• Track CLAUDE.md in the public repo (was gitignored) so Claude Code web sessions receive orientation context on clone.
• Split machine-local/owner context (hosting, domain, Docker, credential paths, owner context) into new gitignored CLAUDE.local.md.
• Added a cloud/web-sessions note to CLAUDE.md covering the constraints those sessions run under.

Test plan

• git check-ignore CLAUDE.md → no output (tracked)
• git check-ignore CLAUDE.local.md WORKERS.md journal/ → all three still ignored
• Diff scrubbed for secret patterns / /home/ubuntu paths → zero hits