docs: align user docs and repo docs with implementation

CLAUDE.md

@@ -14,16 +14,21 @@ The CLI lives at [openbootdotdev/openboot](https://github.com/openbootdotdev/ope
 npm run dev                # Local dev server
 npm run build              # Production build
 npm run check              # Type checking (svelte-kit sync + svelte-check)
+npm run lint               # ESLint
+npm run validate           # check + lint + test (the harness gate)
 npm test                   # Run all tests (vitest)
 npx vitest run src/lib/server/auth.test.ts           # Run a single test file
 npx vitest run -t "test name"                        # Run test by name
 npm run test:coverage      # Tests with coverage report
+npm run install:hooks      # Install git pre-commit/pre-push hooks
 
 # Database
 wrangler d1 migrations apply openboot --local   # Apply migrations locally
 wrangler d1 migrations apply openboot --remote  # Apply migrations to production
 ```
 
+See [AGENTS.md](./AGENTS.md) for harness invariants (no `process.env`, no `console.log` in server code, D1 access scoping) and [docs/HARNESS.md](./docs/HARNESS.md) for the full enforcement model.
+
 Local dev requires `.dev.vars` with `GITHUB_CLIENT_ID`, `GITHUB_CLIENT_SECRET`, `GOOGLE_CLIENT_ID`, `GOOGLE_CLIENT_SECRET`.
 
 ## Architecture
@@ -57,7 +62,7 @@ Three auth flows:
 
 ### Database
 
-D1 (SQLite), no ORM — direct parameterized SQL via `env.DB.prepare(sql).bind(...)`. Four tables: `users`, `configs`, `api_tokens`, `cli_auth_codes`. The `configs.packages` field is a JSON array (stored as `{name, type}` objects; the config endpoint transforms to `{name, desc}` on read, filling descriptions from `package-metadata.ts`). Config visibility: `public` (discoverable), `unlisted` (accessible but not listed), `private` (owner-only, 403 on install).
+D1 (SQLite), no ORM — direct parameterized SQL via `env.DB.prepare(sql).bind(...)`. Five tables: `users`, `configs`, `config_revisions`, `api_tokens`, `cli_auth_codes`. The `configs.packages` field is a JSON array of `{name, type}` objects; on read, endpoints enrich each entry with a `desc` filled from `package-metadata.ts`. Config visibility: `public` (discoverable), `unlisted` (accessible but not listed), `private` (owner-only, 403 on install).
 
 **D1 limitation**: No `ALTER TABLE DROP COLUMN`. Plan column removals via new table + data migration.
 

README.md

@@ -2,7 +2,7 @@
 
 Web dashboard and install API for [OpenBoot](https://github.com/openbootdotdev/openboot).
 
-[![Deploy](https://github.com/openbootdotdev/openboot.dev/actions/workflows/deploy.yml/badge.svg)](https://github.com/openbootdotdev/openboot.dev/actions/workflows/deploy.yml)
+[![CI](https://github.com/openbootdotdev/openboot.dev/actions/workflows/ci.yml/badge.svg)](https://github.com/openbootdotdev/openboot.dev/actions/workflows/ci.yml)
 
 **Live at [openboot.dev](https://openboot.dev)**
 
@@ -41,21 +41,7 @@ GOOGLE_CLIENT_SECRET=...
 
 ## Deployment
 
-**Tag-based releases** — production deploys only happen when you create a version tag:
-
-```bash
-git tag v1.0.0
-git push origin v1.0.0
-```
-
-This triggers:
-1. Tests + build
-2. Database migrations
-3. Deployment to openboot.dev
-
-Push to `main` only runs CI (tests + build), no deployment.
-
-See [RELEASE.md](./RELEASE.md) for full release process.
+Push to `main` runs CI (type check + tests + build) and, on success, auto-deploys to [openboot.dev](https://openboot.dev). PRs run CI only. The deploy job lives in `.github/workflows/ci.yml`; see [docs/HARNESS.md](./docs/HARNESS.md) for the full pipeline.
 
 Secrets needed: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`
 
@@ -82,7 +68,7 @@ Secrets needed: `CLOUDFLARE_API_TOKEN`, `CLOUDFLARE_ACCOUNT_ID`
 
 ## Database
 
-D1 (SQLite). Two tables: `users` and `configs`. See `migrations/` for schema. Key fields:
+D1 (SQLite). Tables: `users`, `configs`, `config_revisions`, `api_tokens`, `cli_auth_codes`. See `migrations/` for schema. Key fields on `configs`:
 
 - `configs.packages` — JSON array of {name, type, desc}
 - `configs.snapshot` — JSON object from CLI `openboot snapshot`