docs(claude): permit the /boss rollback sandbox in the main-sacrosanct rule

The autonomous orchestrator may now git reset --hard its OWN unpushed commits made
this run (above the session anchor) when a line of work dead-ends; pushed and
user-ratified history stays strictly forward-only (git revert, never reset). This
codifies the /boss rollback sandbox the skill assumed but the project rule forbade,
resolving the conflict the auto-mode classifier surfaced. User-authorized.

CLAUDE.md

@@ -28,10 +28,17 @@ outcome — I verify the diff and the test output myself before committing.
 - **Only the orchestrator commits.** No skill agent runs `git commit`; agents
   leave their output as unstaged working-tree changes for me to inspect and shape
   into commits.
-- **main HEAD is sacrosanct.** No `git reset`/`git revert` on main. main moves
+- **main HEAD is sacrosanct — with one narrow `/boss` exception.** As a rule, no
-  forward only via my commits. Wrong agent output is discarded with
+  `git reset`/`git revert` on main: it moves forward only via my commits, and
-  `git checkout -- <paths>`/`git stash`; a bad landing is fixed forward, never
+  **pushed or user-ratified history is never rewound** (a bad landing there is
-  rewound.
+  fixed forward with `git revert`, never `reset`). Wrong agent output is discarded
+  with `git checkout -- <paths>`/`git stash`. **The exception:** under `/boss`,
+  the orchestrator MAY `git reset --hard` to wind back its *own* autonomous,
+  **unpushed** commits made this run — those above the *session anchor* (main HEAD
+  at the run's start) — when it has run a line of work into a genuine dead end.
+  Never below the anchor; never a pushed commit; the discarded attempt is
+  hard-dropped (its trace survives in the run's reference issue). This is the
+  `/boss` rollback sandbox, not a licence to rewrite history.
 - When a commit closes a Gitea issue, reference it in the body: `closes #N`
   (or `refs #N` for non-final work).