chore: add Claude settings, ship/release commands, reviewer agents, changelog

- /ship now commits and pushes with a branch guard and no longer tags;
  /release tags vMAJOR.MINOR.PATCH and confirms before pushing
- operator-reviewer and go-operator-reviewer agents from egress-proxies-operator
- committed permission allowlist; settings.local.json ignored

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -4,7 +4,7 @@ Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
 
 - [x] Step 0 — Save and commit the plan
 - [x] Step 1 — CLAUDE.md
-- [ ] Step 2 — `.claude/` and docs scaffolding
+- [x] Step 2 — `.claude/` and docs scaffolding
 - [ ] Step 3 — Makefile, lint, formatting
 - [ ] Step 4 — Module path and version identity
 - [ ] Step 5 — Baseline tests
@@ -32,3 +32,22 @@ Deviations from the plan:
 
 Worth noting: Commands and CI/CD describe the repo as it is at this commit; Steps 3,
 4 and 6 update them. `docs/flows.md` cites `main.go` line numbers that Step 4 shifts.
+
+## Step 2 — `.claude/` and docs scaffolding
+
+Copied the two reviewer agents and `/ship` from `egress-proxies-operator/.claude/`.
+`/release` was rewritten for the semver rule instead of copied, because the egress
+text says "no tagging scheme is documented" and this repo now has one.
+
+Deviations from the plan:
+
+- `/ship` names "a `Co-Authored-By:` trailer for Claude" instead of the fixed
+  `Claude <noreply@anthropic.com>` string, matching CLAUDE.md.
+- `.gitignore` already covered `/bin/` and `*.out`, so only
+  `.claude/settings.local.json` was added.
+- `settings.json` also allows `kubectl kustomize`, which the Commands section uses.
+
+Worth noting: `.claude/settings.json` leaves out `git commit`, `git push` and
+`git tag` on purpose, but `~/.claude/settings.json` allows `git commit` and
+`git push` globally, so on this machine the push confirmation rests on CLAUDE.md,
+not on the permission system.