chore: add Claude settings, ship/release commands, reviewer agents, changelog

- /ship now commits and pushes with a branch guard and no longer tags;
  /release tags vMAJOR.MINOR.PATCH and confirms before pushing
- operator-reviewer and go-operator-reviewer agents from egress-proxies-operator
- committed permission allowlist; settings.local.json ignored

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.claude/commands/release.md

@@ -0,0 +1,18 @@
+---
+description: Tag a release and push it after confirmation
+---
+
+Commit all staged and unstaged changes into git, assign the next release tag, then
+ask for confirmation before pushing.
+
+Before committing, check the current branch (`git branch --show-current`). Releases
+are cut from `main`; on any other branch, stop and ask.
+
+Tags are semver `vMAJOR.MINOR.PATCH` (see CLAUDE.md, "Git Commits, Pushes and Tags").
+Find the latest with `git tag --list 'v*' --sort=-v:refname | head -1`; if there is
+none, start at `v0.1.0`. The old `0.01`–`0.07` tags are not part of the sequence.
+Default to a patch bump for fixes and a minor bump for features; state the tag you
+picked and why when asking for confirmation.
+
+Pushing the tag triggers `.gitea/workflows/build.yaml`, which builds and pushes the
+image and moves `:latest`.