docs: refresh CLAUDE.md and compliance spec after guideline PR

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -20,7 +20,9 @@ the full build spec live under `.scratch/admin-dump-manager/` and `.scratch/dump
 - Plugin store-config UI fields (e.g. `maxDumps`, `retantionDays`) are defined in
   `src/Resources/config/config.xml` and read at runtime via Shopware's SystemConfigService.
 - `src/Resources/app/administration/` holds the admin UI module (Vue-based Shopware Administration
-  extension), currently just the `swag-example` scaffold module.
+  extension). The `aeon-dump-manager` module (`src/module/aeon-dump-manager/`) provides the list page
+  (`page/aeon-dump-manager-list`), en-GB/de-DE snippets and ACL privilege roles (`acl/`: `viewer`,
+  `creator`, `deleter`); `src/service/dump-api.service.ts` is the client for the dump API routes.
 
 ## Running the plugin
 
@@ -51,6 +53,10 @@ activates this plugin inside a real Shopware kernel for the test run (`KERNEL_CL
 `Shopware\Core\Kernel` in `phpunit.xml`). This means tests require a working Shopware installation/DB
 to bootstrap against — they are not runnable as an isolated PHP package.
 
+In CI (`phpunit` job) a Shopware 6.6 project is prepared once (`composer create-project` + phpunit,
+cached monthly), the plugin is copied into `custom/plugins`, and `system:install` runs once into
+`shopware_test` (MariaDB 10.11 service), so the bootstrapper only activates the plugin.
+
 ```bash
 vendor/bin/phpunit                              # full suite
 vendor/bin/phpunit --filter TestClassName        # single test class
@@ -59,10 +65,29 @@ vendor/bin/phpunit tests/SomeTest.php            # single file
 
 ## Dependencies
 
-- PHP `^8.1`, `shopware/core` `~6.6.0` (from `composer.json`); `phpunit/phpunit` `^10.0` as the only
+- PHP `^8.2`, `shopware/core` `~6.6.0` (from `composer.json`); `phpunit/phpunit` `^10.0` as the only
   dev dependency.
 - PSR-4 autoload: `AeonDumpManager\` → `src/`, `AeonDumpManager\Tests\` → `tests/`.
 
+## CI / release pipeline
+
+Gitea workflows in `.gitea/`, plugin-agnostic (name/version come from `composer.json`). `shopware-cli`
+runs from its official Docker image, intentionally unpinned (`latest`): a red build after a CLI release
+means fix the config.
+
+- `workflows/plugin-checks.yml` (PRs into `main`) has three jobs: `version-changelog` (every PR into
+  `main` must bump `composer.json` version and add a matching `## [x.y.z]` CHANGELOG heading), `package`
+  (shared composite action `actions/package`: `shopware-cli extension package`, `extension validate` on
+  the zip, `scripts/ci/assert-built-assets.sh`), and `phpunit`. The package job caches the tested zip
+  keyed by the commit's tree hash.
+- `workflows/release.yml` (push to `main`, serialized, skipped if tag `v<version>` exists): reuses the
+  cached zip when the tree hash matches (else packages again, always re-validates), creates the Gitea
+  release + tag via API with the zip as asset, publishes to the Composer registry, then links the
+  package to the repo. Uses `RELEASE_TOKEN`.
+- Required checks on `main` (`plugin-checks / version-changelog|package|phpunit (pull_request)`) are set
+  once with `scripts/protect-main.sh` (`tea api`). Build excludes/validation live in
+  `.config/shopware-extension.yml`. Background: `docs/spec/shopware-guideline-compliance.md`.
+
 ## Adding functionality
 
 - New console commands go in `src/Command/`, new scheduled tasks in `src/ScheduledTask/` — both must