add Claude Code setup

[irahopkinson]

Adds Claude Code configuration to this repo, adapted from the sibling
scripture-editors repo and adjusted for this one being npm + a single-package
library rather than pnpm + an Nx monorepo.

No runtime impact: no dependencies change, no build tooling or existing script
changed, and the one new devDependency is never published (files ships dist
and src only).

What's here

CLAUDE.md — commands, CI-matching verification steps, the public API map,
and the port-fidelity rule from the README's Contributing section. It also
records three things that are easy to get wrong:

• There is no typecheck script, and lint is not a substitute. ESLint's
  type-checked rules consume type information but never report compile errors.
  Test files are type-checked by nothing CI runs — npx tsc -p tsconfig.test.json --noEmit is the command for that.
• Dependency updates — this repo takes security Dependabot PRs only, and
  since there are no runtime dependencies, advisories never reach consumers.
  Dependabot's lockfiles are not idempotent, so re-resolve and diff before
  accepting one. One residual brace-expansion advisory is known and accepted;
  pinning minimatch@^10 via overrides silently breaks lint.
• Known porting gaps — members that exist but don't behave like the C#, so a
  ported test can fail for reasons not visible in the source (internalValid()'s
  commented-out range check, isExcluded hardcoded false, set verseNum
  missing the negative guard, BBBCCCVVVS unimplemented, the numeric constructor
  bypassing setters, the BookSet stub).

.claude/settings.json — shared permissions. Every Bash(...) deny/ask rule
has a PowerShell(...) twin, since Bash patterns don't match PowerShell calls and
PowerShell is the primary shell on Windows.

.claude/skills/typescript-lsp-volta/ — a committed skills-directory plugin
providing go-to-definition, find-references and diagnostics, plus
typescript-language-server as a devDependency. It replaces the official
typescript-lsp plugin, which needs a global install and, on Windows, spawns the
binary shell-free so it cannot launch Volta's .cmd shim (ENOENT: uv_spawn).
This one runs the server through node, which works under Volta on every OS.

.mcp.json + scripts/mcp-launcher.mjs — Context7 as a single team-wide
server. settings.json disables the equivalent personal plugin for this project
only, so contributors who have it keep it in their other repos and there's no
post-merge cleanup to remember.

.gitignore, tsconfig.lint.json — track settings.json and skills/ while
keeping local-only files out; let eslint . type-check the launcher.

A caveat worth reading

The permission deny list is defence in depth, not a boundary. Matching is
prefix-based over tokens, so a rule only fires on the exact spelling it names.
Verified during review: git push --force origin main is denied, while
git push origin main --force — the same operation with the flag moved — is not.
A PreToolUse hook is the only form immune to reordering, and is the natural
follow-up if we want a real boundary.

Verification

lint, prettier:ci, build, test:ci (43/43) and
npx tsc -p tsconfig.test.json --noEmit all exit 0. Context7 completes an MCP
handshake through the launcher, and the language server completes an LSP
initialize handshake advertising definitionProvider and referencesProvider.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.93%. Comparing base (766361c) to head (eb15e6f).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #59   +/-   ##
=======================================
  Coverage   83.93%   83.93%           
=======================================
  Files           4        4           
  Lines         330      330           
  Branches       77       77           
=======================================
  Hits          277      277           
  Misses         33       33           
  Partials       20       20           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.