Lint built target package with sbopkglint

After a target builds successfully, run sbopkglint (from
system/sbo-maintainer-tools) against the built .txz as a final
check. Host-side, target only, fail-soft: skips with a note if the
tool is absent and never changes the SUCCESS status. The one-line
result is color-coded (green clean, red findings); on findings the
full output is echoed to the screen and the package log. Verified
live on buildsystem with feh.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 14 insertions, 2 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 5df16b3..139c896 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -84,7 +84,14 @@ Top-to-bottom layout:
    installpkg INSIDE the chroot non-interactively via heredoc, reads back a
    status token file, sets status maps. Logs resolved .info env up front and
    the installed file list (from /var/log/packages) after installpkg, so the
-   overlay is fully disposable.
+   overlay is fully disposable. On a successful TARGET build, runs `lint_pkg`
+   (host-side `sbopkglint` from `sbo-maintainer-tools`) against the built .txz
+   as a final check: target only, fail-soft (skips with a note if the tool is
+   absent, never changes the SUCCESS status). The one-line result is color-coded
+   (`C_GRN` clean / `C_RED` findings); on findings the full sbopkglint output is
+   echoed to the screen (indented) as well as the log, so problems are easy to
+   catch. Called while the overlay is still mounted so the host path to the .txz
+   is reachable; no cache dependency.
 9. **run_target** - fresh overlay per target, builds resolved chain in order,
    marks `BLOCKED-BY-DEP` on dependents of failures, tears down.
 10. **print_summary** - color screen recap + plain `summary.log`.
@@ -136,7 +143,12 @@ recorded separately as a reminder flag, not a status.
   `update_base` (mirror was up-to-date) and therefore the on-patch cache wipe
   firing, and the `bump: OLD -> NEW` eviction path on a real version change
   (covered by the self-check, not yet seen on hardware). Logic mirrors the
-  reference script.
+  reference script. The `sbopkglint` target lint (`lint_pkg`) WAS verified live
+  on buildsystem: a `feh` run ran `sbopkglint` against the built .txz after the
+  target build (lint: clean, full output in the package log), fired for the
+  target only (cached `imlib2` dep not linted), and left SUCCESS unaffected.
+  Pure host I/O against an external tool, no self-check stub (trivial, no branch
+  logic beyond the install check).
 
 ## Known shortcuts (ponytail: comments in source)