fix(compliance): add CLAUDE.md and dependabot.yml

.github/dependabot.yml

@@ -1,12 +1,17 @@
-updates:
-- directory: /
-  ignore:
-  - dependency-name: "github/gh-aw-actions/*" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
-  labels:
-  - security
-  - dependencies
-  open-pull-requests-limit: 10
-  package-ecosystem: github-actions
-  schedule:
-    interval: weekly
 version: 2
+updates:
+  # GitHub Actions — version updates (keep actions current)
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "security"
+      - "dependencies"
+    ignore:
+      - dependency-name: "github/gh-aw-actions/*" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
+    groups:
+      actions:
+        patterns:
+          - "*"

CLAUDE.md

@@ -0,0 +1,28 @@
+# CLAUDE.md — .github-private
+
+This file provides project-specific instructions for Claude Code when working in this repository.
+
+## Development Standards
+
+Read [AGENTS.md](./AGENTS.md) before making any changes. It defines the org-wide standards for CI,
+workflows, agent configuration, and more.
+
+## Repository Purpose
+
+This is the **private org-level `.github-private` repository** for `petry-projects`. It contains:
+
+- **`agents/`** — Copilot custom agent profiles (org-wide, invocable from GitHub.com, VS Code, JetBrains)
+- **`prompts/`** — Prompt libraries used by workflows
+- **`scripts/`** — Shell orchestration for GitHub Actions (PR review, health checks)
+- **`frameworks/`** — Installed agentic frameworks (git subtree)
+- **`.github/workflows/`** — Scheduled automation (PR review, health checks, dependency audit)
+
+## Key Guidelines
+
+- This repo contains shell scripts executed by GitHub Actions — test changes locally with `shellcheck`
+- Some workflows are thin caller stubs (e.g., `claude.yml`, `agent-shield.yml`, `auto-rebase.yml`, `dependabot-automerge.yml`) — do not modify these beyond the allowed inputs noted in their headers and AGENTS.md; others contain org-private automation logic and are not thin callers
+- SHAs for action pinning must be looked up via the GitHub API — never guessed
+
+## Commands
+
+- Lint shell scripts: `shellcheck scripts/*.sh`