DX-412: Add Claude Code instructions distilled from this repo's merged PRs

[boyanbtv]

What this is

We ran 5 of this repository's recently merged PRs through an analysis loop: Claude Code implemented each ticket autonomously from the same starting commit your team had, and a reviewer step compared its implementation and reasoning against your merged result to find the repository knowledge it was missing. The files in this PR are the instructions that would have closed those gaps — so that future AI-assisted work in this repo starts with your team's knowledge instead of rediscovering (or missing) it.

All assets were additionally fact-checked against this repository's current state (commit 2def1a5e3, 2026-06-11) shortly before this PR was opened.

Every asset below explains the concrete evidence it came from. Please treat this as a proposal: take what's useful, edit freely, drop the rest.

Proposed assets

#	Asset	Target	Evidence
C2	Confirm goreleaser injects main.version before relying on it at runtime	.claude/rules/versioning.md	#138

C2 — Confirm goreleaser injects main.version before relying on it at runtime

File: .claude/rules/versioning.md · Evidence: #138

Why this asset — the full reasoning

This repo emits a real client version only in artifacts built by the release pipeline. main.go declares var version = "dev" // Set by goreleaser, and in source, go run, or any plain go build it stays dev. PR #138 made version load-bearing by putting it into the connection's User-Agent header (CloudConnector/<version>) so Support can identify which Cloud Connector version a customer runs from Gloo/CloudFront access logs. PR #138 also added explicit -X main.version={{ .Version }} linker flags to .goreleaser.yaml's build entry so releases would carry a real version — but commit 5419c5f ("dependabot updates and go version bump") later removed those ldflags, and at HEAD the build entry carries none. The coupling is non-obvious and the failure mode is silent: with the ldflags gone, the code still compiles and go test still passes (tests run against the dev default), yet every released client now advertises CloudConnector/dev to the access logs, defeating the header's whole purpose. Unit tests cannot catch this; only a release or snapshot build can. This rule captures the coupling so any change that relies on version confirms build-time injection is actually present (re-adding the ldflag where it has been dropped), and keeps dev as the correct sentinel for local runs.

Also in this PR: versioning .claude/rules/

This repo's .gitignore previously excluded the whole .claude/ directory, which would keep the path-scoped rules above from being versioned or shared. We narrowed it (.claude/* + !.claude/rules/) so the rules travel with the repo — everything else under .claude/ (personal/local files) stays ignored.