feat: add Claude Code installation target

[karngyan]

Claim

Autophagy can now install a shadow-passed, review-approved mutation as a repo-scoped Claude Code skill, alongside the existing Codex target. Most users run Claude Code; before this the only materializer wrote Codex skills.

A Claude Code install writes exactly one file — <repo>/.claude/skills/autophagy-<id>/SKILL.md — with name/description YAML frontmatter and a Markdown body containing the reviewed instruction, the exact versioned trigger selectors, the exclusions, and an evidence footer citing the exact supporting/counterexample AEP event IDs plus the mutation ID and version.

What changed

• autophagy-install: introduced an InstallTarget enum (Codex, ClaudeCode) that parameterizes one shared code path — planning, non-overwrite materialization (create_new), symlink-escape refusal, and byte-exact drift-checked rollback are all target-agnostic. The target only selects the skill directory (.agents/skills vs .claude/skills), the registry identifier (codex_repo_skill vs claude_code_repo_skill), and the agent named in the body. plan_codex_skill stays as a thin wrapper and CodexSkillPlan as a type alias, so existing callers are unaffected. The Codex body is byte-for-byte unchanged.
• Store: migration 0007 recreates mutation_installations (SQLite cannot alter a CHECK in place) with target IN ('codex_repo_skill','claude_code_repo_skill') and a relative_path check that accepts either skill path; existing rows copy forward. The registration validator accepts both targets with their matching path prefix.
• CLI: mutations install gains --target codex|claude-code, defaulting to codex (existing behavior and --output json shape unchanged; the report now also carries target). mutations uninstall needs no flag — it reconstructs the materializer from the stored audit target.
• macOS viewer: bumped knownSchemaVersion 6 → 7 so the read-only app treats v7 (the new default) as .supported rather than "newer-than-known".
• Docs: rewrote docs/guides/shadow-and-installation.md to cover both targets; added ADR 0006 (required because a stored schema changed); updated the schema doc and the ADR 0005 known-version note.

Evidence

• mise run check passes (fmt, clippy -D warnings + pedantic, cargo test --workspace, pandoc GFM docs, actionlint).
• swift test for apps/macos passes (25 tests).
• New tests: install-crate round-trip for Claude Code (deterministic plan, evidence footer with exact event IDs, non-overwrite, symlink-escape refusal, drift refusal, reversible reinstall, distinct-from-Codex plan, registry-id round trip); store-level Claude Code registration/audit/uninstall + unknown-target rejection; CLI-level --target claude-code dry-run JSON asserting target and .claude/skills path.
• End-to-end smoke on a temp git repo: fixture DB → propose → challenge → replay → shadow → install --target claude-code produced a valid SKILL.md (frontmatter + instruction + selectors + exclusions + evidence footer citing evt_failure_1..3 and evt_success_1, mutation ID, version 0.1.0) → uninstall removed the skill and its directory and transitioned the mutation to retired.

Privacy implications

Preserves the local-first, offline, reversible guarantees. One file is written inside the user-selected Git repository only after the mutation passes challenge/replay/shadow and the user supplies the exact repo-skill-write confirmation phrase. Nothing is written to ~/.claude, global config, hooks, slash commands, or off the machine. The body is deterministic, already-redacted, reviewed content plus the exact evidence identifiers the project requires derived findings to retain. Uninstall removes the file and directory and refuses to touch content whose hash no longer matches.

Note on migrations

Added migration 0007; origin/main currently tops out at 0006. A concurrent PR (synthesis / mutations contract v0.2) may also add a store migration — if so, expect a renumber of 0007 at merge time (rename the file, bump the version/include_str! in migration.rs; the migration-count assertions in store.rs are literal 7s that would also move, while the version-check tests in migration.rs are already computed dynamically).

🤖 Generated with Claude Code