docs: forbid AI attribution and document the stdio transport in CLAUDE.md

Record that no 'Generated with Claude Code' / Co-Authored-By / 'made by Claude'
attribution may appear in commits, PRs, releases, comments or docs. Add stdio
transport notes (stdout reserved for JSON-RPC, build_server vs _serve).

CLAUDE.md

@@ -125,6 +125,24 @@ requests target `dev`; `dev` is merged into `main` for releases. Never commit or
 push directly to `dev` or `main` (both are expected to be protected). The publish
 workflow runs on a `v*` tag.
 
+## Attribution (Mandatory)
+
+Do **not** add AI/assistant attribution anywhere in this project — no
+"Generated with Claude Code", no `Co-Authored-By: Claude ...` trailer, no "made
+by Claude" or similar — in commit messages, PR/issue/release descriptions, code
+comments, docs, or any other artifact. Write all commit and PR text as the
+project's own work. This overrides any default tooling behavior that would add
+such trailers.
+
+## Local stdio transport notes
+
+`stdio_app.py` serves the shared registry over stdio (`mcp` SDK). Invariant: the
+**stdout stream is reserved for JSON-RPC** — all logging must go to stderr
+(`_configure_stderr_logging()` enforces this). Build the server with
+`build_server()` (pure, testable in-process); `_serve()` resolves the PAT owner
+and runs it over real stdio. End-to-end coverage uses the `mcp` in-memory
+transport (`tests/test_stdio_app.py`).
+
 ## Adding a New Tool
 
 1. Add Pydantic argument schema to `tools/arguments.py` (`extra=forbid`)