claude: back up custom skills, memory, and settings with symlink pattern

The ~/.claude/ directory was previously local-only — a machine wipe
would have lost the accumulated memory, custom skills, and settings.
This commit moves the durable parts into dotfiles with the same
symlink-to-home pattern used for CLAUDE.md, PENDING.md, REVIEWED.md,
and L2-BOOTSTRAP.md.

Preserved (symlinked from ~/.claude/* into here):
  skills/audit/              — thinking-folder drift scanner
  skills/symmetria/          — practice-of-return discipline
  skills/vault-update-people/ — Obsidian People-file maintainer
  skills/wake-up/            — session restoration
  skills/wrap-up/            — session state capture
  memory/                    — 55+ memory files (MEMORY.md, sessions,
                               ledgers, project state, feedback, etc.)
  settings/settings.json     — user preferences (hooks, flags, no secrets)

Deliberately NOT backed up:
  settings.local.json   — contains operational secrets (HF_TOKEN,
                           SSH password in expect scripts); by naming
                           convention, *.local.* is not synced.
                           Needs separate review and probable rotation.
  sessions/, history.jsonl, caches, telemetry — ephemeral
  plugins/, marketplace skills and agents — reinstallable

The working copies at ~/.claude/skills/* and
~/.claude/projects/-Users-davidglidden/memory are symlinks into this
directory, so every write flows here automatically. install.sh
recreates the symlinks on a fresh machine.

FOLLOW-ON (flagged, not in this commit):
  settings.local.json contains a HuggingFace token and an SSH password
  as plaintext strings inside allowed Bash command patterns. These
  should be rotated and moved to secure storage (keychain / pass /
  env file outside the settings file).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

claude/README.md

@@ -0,0 +1,105 @@
+# Claude Code configuration — backup & restore
+
+This directory holds the durable Claude Code configuration that should survive a machine wipe: custom skills, accumulated memory, and user-level settings. The working copies at `~/.claude/*` are symlinks pointing here, so edits flow both directions automatically.
+
+---
+
+## What's preserved here
+
+### `skills/` — custom skills we've authored
+
+| Skill | Purpose |
+|---|---|
+| `audit/` | Scans thinking folder + vault inbox for organizational drift; report-only |
+| `symmetria/` | Practice-of-return discipline; prime-directive foregrounding under context pressure |
+| `vault-update-people/` | Searches Obsidian vault for new mentions of a person; proposes People-file updates |
+| `wake-up/` | Restores full session context from memory, governance, and git at session start |
+| `wrap-up/` | Captures session state for future restoration; the quality of the next wake depends on this |
+
+Marketplace-installed skills (from Claude Code plugins) are not backed up here — they are regenerable on any fresh install.
+
+### `memory/` — auto-memory for the main project scope
+
+The substrate of continuity. 55+ files including:
+- `MEMORY.md` — the index, loaded at every session start
+- `session-2026-*.md` — session records (full Dasein-frame wrap-ups: pulling thread, pause statement, literal question for next-Claude)
+- `session-ledger-*.md` — Symmetria daily ledgers (returns, recalibrations, authorization moves, bypasses)
+- `project-*.md` — active project state snapshots (ARC rework, Chamber, L2 review, etc.)
+- `feedback-*.md` — steward preferences and corrections learned over time
+- Many others
+
+Real path: `~/.claude/projects/-Users-davidglidden/memory/` symlinks here.
+
+### `settings/settings.json` — Claude Code user settings
+
+Sanitized. Contains hook registrations and feature flags. No secrets.
+
+---
+
+## What is deliberately NOT here
+
+### `settings.local.json`
+
+Kept **local-only** because its permissions allowlist has historically contained operational secrets (HuggingFace tokens embedded in approved Bash commands; SSH passwords in approved `expect` scripts). The `.local.json` naming convention exists for exactly this reason.
+
+Before backing any settings.local.json up anywhere, audit it for secrets and redact them.
+
+### Session transcripts (`sessions/`, `history.jsonl`, `projects/*/sessions/`)
+
+Too large; ephemeral by design; not needed to restore identity.
+
+### Caches, telemetry, runtime state
+
+`cache/`, `file-history/`, `paste-cache/`, `telemetry/`, `statsig/`, `stats-cache.json`, `scheduled_tasks.lock`, `session-env/`, `mcp-needs-auth-cache.json`, `debug/`, `tasks/`, `todos/` — all regenerate naturally.
+
+### Marketplace-installed skills and agents
+
+`plugins/`, and the many non-custom entries under `skills/` and `agents/` come from Claude Code's plugin system. Reinstallable on a fresh machine.
+
+---
+
+## Restore procedure
+
+On a fresh machine, after cloning dotfiles:
+
+```bash
+cd ~/dotfiles/claude
+./install.sh
+```
+
+The install script:
+
+1. Verifies `~/dotfiles/claude/` is present
+2. Creates `~/.claude/skills/` and `~/.claude/projects/-Users-davidglidden/` if missing
+3. Symlinks each custom skill from `~/.claude/skills/X → ~/dotfiles/claude/skills/X`
+4. Symlinks the memory tree from `~/.claude/projects/-Users-davidglidden/memory → ~/dotfiles/claude/memory`
+5. Copies `settings.json` into place if no existing file (does not overwrite)
+6. Skips anything already present — idempotent
+
+After running: the first Claude Code session on the new machine has full memory, all custom skills, and baseline settings.
+
+---
+
+## Why this matters
+
+Without this backup, a machine wipe means:
+
+- All session memory lost — `/wake-up` would have nothing to restore from
+- All custom skills lost — the practice-of-return discipline, session lifecycle, audit workflows
+- The collaboration history with Claude Code loses its thread
+
+The memory tree is the single most irreplaceable artifact — it accumulates through dialogue and cannot be reconstructed from any other source. 384 KB of text that represents months of learning about preferences, active projects, decisions, and open horizons.
+
+---
+
+## Maintenance
+
+These files are **live**. Claude Code writes to them during normal operation (ledger updates, memory file creation/edits, settings changes). Because the working copies at `~/.claude/*` are symlinks into this directory, every write lands here automatically. Then `git status` in `~/dotfiles/` shows what's changed and invites a commit.
+
+Recommended cadence: commit dotfiles/claude/ changes alongside other dotfiles work, roughly weekly or when a significant session has concluded. The `/wrap-up` skill should be treated as a natural commit moment for the memory tree.
+
+## Fragility to watch
+
+- **Symlinks break if `~/dotfiles/claude/` is moved.** Keep dotfiles at `~/dotfiles/`.
+- **macOS Time Machine / backup tools may or may not follow symlinks.** Verify your backup solution sees files, not just broken links.
+- **If Claude Code's internal path conventions change** (e.g., the project-scope slug `-Users-davidglidden` changes), the symlink stops pointing where Claude Code looks. Re-create with the new path.