docs(ci): the tend environment-deployments gap closed with #3749

[worktrunk-bot]

Nightly sweep finding: the last paragraph of "Environment protection" in .github/CLAUDE.md describes a gap that closed the same night it was written.

#3748 added the paragraph saying the generated tend-*.yaml files "still carry the bare environment: tend" and that tend check's environment-deployments "fails until a uvx tend@latest init regen lands them on tend ≥ 0.1.14". #3749 merged 3 hours later and did exactly that regen — every generated job now reads {name: tend, deployment: false}, and tonight's tend check reports environment-deployments as PASS. Left as-is, the file tells the next reader to expect a failure that no longer happens and a regen that already ran.

The rewrite keeps the durable half — the generated files aren't hand-edited, because uvx tend@latest init overwrites them — and states the resolution instead of the pending action.

Evidence

Current state of the generated files (all eight are identical in shape):

$ grep -A2 'environment:' .github/workflows/tend-nightly.yaml
    environment:
      name: tend
      deployment: false

Tonight's tend check, run by the nightly sweep:

  PASS  environment-deployments — No job files a deployment for the 'tend' environment

The three checks still failing (credential-environments, claude-auth, repo-secret-allowlist) are tracked in #3729 and are repository-settings changes, unrelated to this file. #3760 edits the same section but not these lines, so the two don't conflict.

No test accompanies this — it's a documentation-only change to a file no test reads.