Stop tracking .claude/settings.json; run BiocCheckGitClone in CI again

[joshua-d-campbell]

Warning

Pulling this branch deletes your .claude/settings.json. Git removes
the file because it is no longer tracked. Without it, Claude Code runs with
neither the shared standards nor the permission guardrails. After you pull
(or merge devel into your branch), every developer must run

make claude-setup

in a terminal outside Claude Code (not with !, which runs inside
Claude Code and is refused), then restart claude. Do it once in each clone
and worktree you use.

What changed and why

BiocCheck 1.49 (Bioc 3.24) reports Git-tracked .claude/ files as an error.
This follows "Migrating a package that tracks .claude/" in
r-bioc-dev-standards v1 ADOPTING.md (campbio/r-bioc-dev-standards#8).

• dev/claude-settings.json (new): holds only this package's own rules,
  the ones the shared shared/claude-settings.json lacks:

  • allow: make help, make build, make app, make test-app,
    git blame, and git fetch compbiomed
  • deny: git push --force-with-lease, make site, and rm -fr

  make claude-setup merges it with the shared settings into
  .claude/settings.json. The old Write(...) denies are not carried over
  because the shared settings dropped them.

• .gitignore: .claude/settings.local.json becomes .claude, and
  .claude/settings.json is no longer tracked
  (git rm -r --cached .claude).

• .worktreeinclude (new): Claude Code copies the gitignored
  .claude/settings.json into new worktrees. It's added to .Rbuildignore.

• AGENTS.md: tells Claude to stop and ask for make claude-setup when
  the standards are missing from its context.

• CI: reverts the stopgap from Run CI against Bioconductor devel; fix macOS and batchelor warnings #807 (14fc41e), so BioC-check.yaml
  runs BiocCheck(".") on the Git checkout again. On a Git clone that also
  runs BiocCheckGitClone. ADR 0007 (still Proposed) drops the tarball
  bullet and keeps the OpenSSL include-path change from the same commit.

How it was tested

• After make claude-setup, the generated settings match the old file
  except for: entry order (package rules now come after the shared ones),
  the 13 Write(...) denies that were dropped on purpose, and three new
  shared denies (Edit(dev/claude-settings.json), make claude-setup).
  The hooks are unchanged.
• make bioccheck in a clean clone of this branch:
  • BiocCheckGitClone: 0 errors and 0 warnings. The one NOTE is the
    optional CITATION.
  • BiocCheck on the 3.41 MB tarball: 0 errors and 3 warnings, none from
    this PR (no R code changed):
    • "y should be even in release": local BiocCheck runs under Bioc 3.23
      (release), so it treats the devel version 2.23.6 as a release version.
    • class() == in plotSCEHeatmap.R: existing code.
    • The .Deprecated/.Defunct count: existing code.
  • The check fails in the main working tree only because BiocCheck 1.48
    scans the gitignored local .worktrees/ checkouts. CI has no
    .worktrees/.
• Local BiocCheck is 1.48.1 (Bioc 3.23), which doesn't have the .claude/
  rule. This PR's BioC-check job (Bioc devel, BiocCheck 1.49) is the real
  test of that rule.

Checklist

• Tests added or updated, make test passes, and make coverage
  didn't drop (N/A: no R code changed)
• make check-full and make bioccheck pass with no new errors or warnings
• make docs run, if roxygen comments changed (N/A)
• New exports added to _pkgdown.yml, and make site-check passes (N/A)
• NEWS.md updated for user-facing changes (N/A: developer tooling only)
• Version bumped (z) if this will be pushed to Bioconductor (N/A: not
  user-facing)
• Plan review and /code-review run; findings fixed or answered
• Related issue linked (BiocCheck 1.49 errors on Git-tracked .claude/settings.json campbio/r-bioc-dev-standards#8)
• Shiny only: verified with a screenshot of the running app (N/A)

ADR

Amends the Proposed dev/adr/0007-ci-against-bioc-devel.md (removes the
"Run BiocCheck on the built tarball" bullet). Otherwise N/A.

Scientific correctness

Generated content

Claude Code wrote all of it: the settings migration, the AGENTS.md
paragraph (copied from the standards template), the CI revert, and this
description. The maintainer ran make claude-setup.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.26%. Comparing base (3a4e70b) to head (41d3533).

Additional details and impacted files

@@           Coverage Diff           @@
##            devel     #809   +/-   ##
=======================================
  Coverage   53.26%   53.26%           
=======================================
  Files          80       80           
  Lines       13360    13360           
=======================================
  Hits         7116     7116           
  Misses       6244     6244           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.