CLAUDE.md: document fork setup, file modes, symlink cleanup

Three things a future session would otherwise have to rediscover:

- How to recreate the fork clone. Its path was recorded but not the
  setup, and .git/config isn't tracked, so a re-clone silently loses
  user.name=danix and commits revert to the global name. Adds the
  three identity conditions and how to verify them on a live PR.
- The 0644 requirement, and that git tracks the exec bit, which is how
  SecLists and gobuster carried 0755 until sbolint started running.
  Includes the fix and a repo-wide audit command.
- Symlink cleanup now says to run it from the repo root; the old note
  predates the category layout, where a package-dir-relative find
  misses other categories.

1 files changed, 46 insertions, 2 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 96f0fdd..7316637 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -324,8 +324,34 @@ SBOLINT=no git commit -m'Message here'
 ```
 
 Note: `sbodl` creates symlinks in the package directory pointing to downloaded
-sources. Remove them before staging (`find . -type l -delete`); they must never
-be committed.
+sources. Remove them before staging; they must never be committed. Run it from
+the repo root so no package is missed:
+
+```bash
+find . -type l -print -delete
+```
+
+The `pre-commit` hook also strips staged symlinks to source archives and blocks
+staged *real* archives, but do not rely on that as the only guard.
+
+### File modes: 0644
+
+SBo requires 0644 for files and 0755 for directories, and the upload form
+rejects otherwise. Git tracks the exec bit, so a `.SlackBuild` that was ever
+`chmod +x` carries 0755 into the repo. `sbolint` catches it
+(`must have mode 0644, not 0755`), which is one reason the pre-commit hook has
+to actually run. To fix, both on disk and in the index:
+
+```bash
+chmod 644 <category>/<pkg>/<file>
+git add --chmod=-x <category>/<pkg>/<file>
+```
+
+Audit the whole repo (`.extras/hooks/` at 0755 is correct, those are hooks):
+
+```bash
+git ls-files --stage | awk '$1!="100644" && $4 !~ /^\.extras/ {print $1, $4}'
+```
 
 ---
 
@@ -368,6 +394,24 @@ have unrelated histories:
   user.name = danix   (local override, matches .info MAINTAINER)
 ```
 
+To recreate it (the clone is ~265MB, and `.git/config` is not tracked, so a
+fresh clone silently loses the name override and commits revert to the global
+`Danilo M.`):
+
+```bash
+gh repo fork SlackBuildsOrg/slackbuilds --clone=false
+git clone github:danixland/slackbuilds.git ~/Programming/GIT/GITHUB/slackbuilds
+cd ~/Programming/GIT/GITHUB/slackbuilds
+git remote add upstream https://github.com/SlackBuildsOrg/slackbuilds.git
+git config --local user.name danix     # email + GPG signing come from global
+```
+
+Identity must satisfy three things, all verifiable on a pushed commit with
+`gh api repos/SlackBuildsOrg/slackbuilds/pulls/<n>/commits`: the author email
+matches `.info` EMAIL, the email is verified on the `danixland` account (so
+`.author.login` is set, not null), and the GPG key is uploaded there (so
+`.commit.verification.verified` is true). All three held as of 2026-08-08.
+
 Because this repo mirrors SBo's `<category>/<package>/` layout, a package
 directory copies across at the identical relative path, no mapping needed: