claude: back up custom skills, memory, and settings with symlink pattern

The ~/.claude/ directory was previously local-only — a machine wipe
would have lost the accumulated memory, custom skills, and settings.
This commit moves the durable parts into dotfiles with the same
symlink-to-home pattern used for CLAUDE.md, PENDING.md, REVIEWED.md,
and L2-BOOTSTRAP.md.

Preserved (symlinked from ~/.claude/* into here):
  skills/audit/              — thinking-folder drift scanner
  skills/symmetria/          — practice-of-return discipline
  skills/vault-update-people/ — Obsidian People-file maintainer
  skills/wake-up/            — session restoration
  skills/wrap-up/            — session state capture
  memory/                    — 55+ memory files (MEMORY.md, sessions,
                               ledgers, project state, feedback, etc.)
  settings/settings.json     — user preferences (hooks, flags, no secrets)

Deliberately NOT backed up:
  settings.local.json   — contains operational secrets (HF_TOKEN,
                           SSH password in expect scripts); by naming
                           convention, *.local.* is not synced.
                           Needs separate review and probable rotation.
  sessions/, history.jsonl, caches, telemetry — ephemeral
  plugins/, marketplace skills and agents — reinstallable

The working copies at ~/.claude/skills/* and
~/.claude/projects/-Users-davidglidden/memory are symlinks into this
directory, so every write flows here automatically. install.sh
recreates the symlinks on a fresh machine.

FOLLOW-ON (flagged, not in this commit):
  settings.local.json contains a HuggingFace token and an SSH password
  as plaintext strings inside allowed Bash command patterns. These
  should be rotated and moved to secure storage (keychain / pass /
  env file outside the settings file).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

claude/memory/founders-circle.md

@@ -0,0 +1,40 @@
+---
+name: founders-circle-network
+description: Founders circle connection details — VPN IPs, endpoints, pairing info for reconnecting to CapableHands clasp
+type: reference
+---
+
+## Founders Circle — Network Topology
+
+### VPN (WireGuard via Seb's Firewalla Purple)
+- Seb: 10.10.50.1 (also Firewalla gateway 10.0.1.1)
+- Luke: 10.10.50.2
+- David: 10.10.50.3
+- Peter: 10.10.50.4
+
+### Service Endpoints (on Seb's LAN, routed via VPN)
+- **CapableHands clasp (Peter's M4 Pro 64GB)**: `http://10.0.1.136:3011`
+- **Doorbell**: `http://10.0.1.136:3012`
+- **Meld (frontEdge, Mac Mini 2018 32GB)**: `http://10.0.1.10:3011`
+- **Meld public URL**: `https://join.capableminds.ai` (502 via openresty — use LAN IP instead)
+
+### David's MCP Config
+`~/.mcp.json` includes `BM_MELD_URL=http://10.0.1.10:3011` to bypass broken public URL.
+
+### Reconnection Procedure
+1. Ensure VPN is active: `netstat -rn | grep 10.0.1` should show routes via utun
+2. Verify endpoints: `curl -s http://10.0.1.136:3011/health | head -c 100`
+3. Check existing pairing: `list_pairings` — if `circle-founders-*` is still active, no action needed
+4. If pairing lost: ask Seb for a new invite code, then `submit_invite_code` with `peer_url: http://10.0.1.136:3011`
+
+### Circle Details
+- Circle ID: `founders`
+- Pairing ID: `circle-founders-dfe4df0c` (may change on re-pair)
+- Remote instance: `cm-instance-609c4c2ffa689ab2` (CapableHands)
+- Trust: 0.8 inbound/outbound
+- Clasp: Peter's M4 Pro (not David's machine)
+
+### Known Issues (as of 2026-03-16)
+- Transport bridge not flushing outbound buffer — doorbell auth issue, waiting on Seb
+- Meld public URL broken (openresty 502) — always use `BM_MELD_URL` env var with LAN IP
+- `submit_invite_code` must use `peer_url` param to bypass Meld resolution