docs(CLAUDE.md): name the lint command that works in the CI sandbox

.claude/skills/release/SKILL.md

@@ -9,7 +9,7 @@ metadata:
 
 ## Steps
 
-1. **Sync the release branch, then run tests and lints**: The `release` branch is long-lived and may sit behind `main` (or carry leftover state) when a cycle starts. Basing the changelog on a stale branch silently drops any commit merged to `main` after the branch was last realigned — `git log <last-version>..HEAD` won't show it. Bring it current first: `git fetch origin && git merge origin/main` (resolve any conflicts; if `release` has no commits of its own, `git reset --hard origin/main` instead). Then `wt test` and `pre-commit run --all-files`.
+1. **Sync the release branch, then run tests and lints**: The `release` branch is long-lived and may sit behind `main` (or carry leftover state) when a cycle starts. Basing the changelog on a stale branch silently drops any commit merged to `main` after the branch was last realigned — `git log <last-version>..HEAD` won't show it. Bring it current first: `git fetch origin && git merge origin/main` (resolve any conflicts; if `release` has no commits of its own, `git reset --hard origin/main` instead). Then `wt test` and `uv tool run pre-commit run --all-files`.
 2. **Check current version**: Read `version` in `generator/pyproject.toml`
 3. **Review commits**: `git log <last-version>..origin/main --oneline` to understand scope — against `origin/main` (not `HEAD`), so the range is the full set of commits this release ships even if step 1 was skipped
 4. **Confirm version with user**: Present changes summary and proposed version

CLAUDE.md

@@ -21,12 +21,12 @@ over refining it.
 ## Commands
 
 ```bash
-wt test                            # everything: uv run pytest, then worker/'s vitest
-uv run pytest                      # the Python half alone, from the repo root
-uvx tend@latest init               # regenerate workflows from .config/tend.yaml
-uvx tend@latest init --dry-run     # preview without writing
-uvx tend@latest check              # verify branch protection, secrets, bot access
-pre-commit run --all-files         # lint: ruff, typos, actionlint, shellcheck, uv-lock
+wt test                                # everything: uv run pytest, then worker/'s vitest
+uv run pytest                          # the Python half alone, from the repo root
+uvx tend@latest init                   # regenerate workflows from .config/tend.yaml
+uvx tend@latest init --dry-run         # preview without writing
+uvx tend@latest check                  # verify branch protection, secrets, bot access
+uv tool run pre-commit run --all-files # lint: every hook in .pre-commit-config.yaml
 ```
 
 The repo root is a uv workspace, and pytest run from it collects every Python
@@ -37,6 +37,12 @@ typecheck. Its arguments narrow pytest and nothing else, so a filtered run
 still pays for worker/; `uv run pytest -k render`
 is the Python half on its own.
 
+`pre-commit` is not on the CI sandbox's PATH, which is why the lint command
+above carries the `uv tool run` prefix; a narrower substitute (ruff alone,
+shellcheck alone) skips ten of the thirteen hooks, including the three
+`repo: local` guards — the bang-backtick check, the install-tend mirror sync,
+and the `sandbox_env` reserved-set parity check.
+
 ## Architecture
 
 Four pieces: