docs: CLAUDE.md — push-retry rule and version-consistency invariant

- Document that git push to gitea.gecheckt.de occasionally returns
  Unauthorized on the first attempt and must be retried once after a
  1 s wait before reporting an auth failure.
- Codify the version-consistency invariant: pyproject.toml, uv.lock,
  and the latest CHANGELOG heading must move together;
  src/mcp_synology_container/__init__.py reads __version__ from
  importlib.metadata and is never hand-edited.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

CLAUDE.md

@@ -26,6 +26,11 @@ containers, images, compose files, networks, and system housekeeping.
 3. Restart Claude Desktop (tray icon → Quit → relaunch)
 ```
 
+**Push retry:** the Gitea remote (`gitea.gecheckt.de`) occasionally
+returns `Unauthorized` on the first push attempt. If `git push` fails
+with an auth error, wait 1 s and retry once before reporting back.
+Only a second consecutive failure is treated as a real auth problem.
+
 ---
 
 ## Implemented tools (23)
@@ -72,6 +77,11 @@ containers, images, compose files, networks, and system housekeeping.
 - Type hints and docstrings everywhere
 - Formatter: `ruff format` · Linter: `ruff check` · Tests: `pytest`
 - All text (docstrings, comments, README): English
+- **Version consistency:** the package version lives in `pyproject.toml`
+  and must stay in sync with `uv.lock` and the `[X.Y.Z]` heading in
+  `CHANGELOG.md`. `src/mcp_synology_container/__init__.py` derives
+  `__version__` from `importlib.metadata` and is never hand-edited.
+  Every version bump touches all three files in the same commit.
 
 ---