CLAUDE.md palette now two enforceable lists (6 brand + 8 documented neutrals — anything else is a violation); workflow gains the recompute- CSP-hash-after-JS-edit invariant with the exact command. README points to the neutrals list. TOUR.md follow-up: CLN-3/CLN-4/SEC-7 closed, INF-2 corrected (false positive — .gitignore exists).