fix(boss): name the user-level CLAUDE.md layer, not just the project one

boss pointed at 'the project's CLAUDE.md' as the sole source of
universal rules, in both the Iron Law and the cross-references.
That misses the user-level ~/.claude/CLAUDE.md identity/security
layer, which the dev architecture documents as loaded in every
session above the project file — and which carries the most
autonomy-relevant binding of all: external-service-consent rules
that explicitly name /boss and that autonomy does not lift.

The asymmetry was one-directional: the user-level file is
boss-aware (it constrains /boss by name), but boss was not
user-level-aware. Reference both layers so a reader deriving
'what binds me' from boss alone cannot miss the top layer. No
user-specific content is encoded — the consent rule is named
generically and portably.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

boss/SKILL.md

@@ -61,7 +61,11 @@ A NEW CYCLE NEVER STARTS AUTONOMOUSLY — IT IS A BOUNCE-BACK.
 
 Universal rules (only-orchestrator-commits, main-is-sacrosanct,
 language, RED-first for bugs) come from the project's `CLAUDE.md`
-and apply regardless of mode. This skill does not restate them.
+— and from the user-level `~/.claude/CLAUDE.md` identity/security
+layer above it, loaded in every session. Both bind regardless of
+mode; autonomy does not lift a user-level constraint (e.g. an
+external-service-consent rule that names `/boss` explicitly). This
+skill does not restate them.
 
 ## The Process
 
@@ -343,6 +347,10 @@ actionable ask, not a wrap-up summary.
 - **Universal rules:** the project's `CLAUDE.md` — orchestrator
   role boundaries, commit discipline, design rationale,
   authority over skills, feature acceptance, RED-first for bugs.
+  Plus the user-level `~/.claude/CLAUDE.md` (identity/security
+  layer, loaded in every session, above the project file) — it
+  carries constraints that bind autonomous runs too, including
+  external-service-consent rules that `/boss` does not lift.
 - **Queue:** the URL configured under `git.issue_tracker.url` in
   the profile; CLI command at `git.issue_tracker.list_cmd`.
 - **Glossary write-rule:** `../docs/glossary-convention.md` —