docs: rewrite CLAUDE.md to house conventions, fix flows.md and README

- CLAUDE.md in five sections with Go, testing, plan, changelog, branching
  and tagging rules; known sharp edges moved to Gotchas
- docs/flows.md: metrics are served on :8080, name collisions are rejected
  by the API server, last-cert deletion never cleans up
- README moved to the repo root, deploy command corrected

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans-executions/2026-10-08-2028-house-conventions.md

@@ -3,10 +3,32 @@
 Plan: `docs/plans/2026-10-08-2028-house-conventions.md`
 
 - [x] Step 0 — Save and commit the plan
-- [ ] Step 1 — CLAUDE.md
+- [x] Step 1 — CLAUDE.md
 - [ ] Step 2 — `.claude/` and docs scaffolding
 - [ ] Step 3 — Makefile, lint, formatting
 - [ ] Step 4 — Module path and version identity
 - [ ] Step 5 — Baseline tests
 - [ ] Step 6 — CI build workflow
 - [ ] Step 7 — Close out
+
+## Step 1 — CLAUDE.md
+
+Rewrote `CLAUDE.md` in the five-section shape. The Go, Testing, Changelog and
+Branching text comes from the `go-project-bootstrap` skill references; the plan
+ordering and execution-summary rules come from `egress-proxies-operator/CLAUDE.md`,
+condensed from prose into bullets.
+
+Deviations from the plan:
+
+- The house container rules about Ubuntu dev images and separate dev/prod
+  Dockerfiles were left out: this repo has one production Dockerfile and no dev
+  image, and listing rules nobody follows only adds noise.
+- The `listener-port` row was removed from the annotation table and moved to
+  Gotchas, so the table lists only what works.
+- Added a short Reviews subsection so the reviewer agents and `docs/reviews/` have a
+  documented trigger.
+- `README.md` also claimed that deleting a certificate removes its listeners
+  "instantly". Reworded and added the known limitation.
+
+Worth noting: Commands and CI/CD describe the repo as it is at this commit; Steps 3,
+4 and 6 update them. `docs/flows.md` cites `main.go` line numbers that Step 4 shifts.