chore: update CLAUDE.md

[localops-root]

Summary

Verified CLAUDE.md against the current codebase (action.yml, src/main.ts, package.json, rollup.config.ts, .github/workflows/*, script/release, README.md). Found and fixed three drift items:

• @actions/github dependency gap: src/main.ts imports @actions/github, but it is not declared in package.json's dependencies (only @actions/core and ky are). It currently resolves only because it's a transitive devDependency of @github/local-action. Added a note to the Tech Stack section flagging this as fragile.
• check-dist.yml build command: CLAUDE.md said the workflow rebuilds via npm run package; it actually runs npm run bundle (format:write + package). Corrected.
• licensed.yml trigger: CLAUDE.md described the license-compliance check without noting that its pull_request/push triggers are commented out in the workflow file — it currently only runs on manual workflow_dispatch (which also refreshes/commits the .licenses/ cache), so it is not part of the automatic per-PR CI gate. Added this, plus noted the other catch-all in the allowed-licenses list.

Everything else in the doc (inputs/outputs contract, runtime flow in src/main.ts, Node version pinning, ci.yml/linter.yml/codeql-analysis.yml behavior, script/release steps, testing notes) checked out accurate against the current code — no rewrite, just these targeted corrections.

Test plan

• Read through action.yml, src/main.ts, package.json, package-lock.json, rollup.config.ts, all .github/workflows/*.yml, script/release, README.md and cross-checked each claim in CLAUDE.md
• git diff CLAUDE.md reviewed for accuracy of the changes
• N/A — documentation-only change, no code/build/test impact

---

Generated by Claude Code