feat: split machine-specific section out of CLAUDE.md

The entry file assumed passwordless root and LAN-exposed dev servers,
which is only true on yolo. It now @imports ~/.claude/machine.md, linked
from claude-md/machines/<name>.md via programs.agentSkills.machine.
Defaults to the conservative profile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

entry/CLAUDE.md

@@ -1,14 +1,6 @@
 # Global Context
 
-## Environment
-- Root password: `$SANDBOX_PASSWORD`, already exported from `~/.env.claude` in every shell. Use `printf '%s\n' "$SANDBOX_PASSWORD" | sudo -S <command>`. Never echo or print the value.
-- Can install packages as needed using sudo
-- This machine communicates with external services — treat it as a networked environment
-- **This is a VM accessed from other devices.** When starting any dev server / web service / preview, always bind to `0.0.0.0` (e.g. `vite --host 0.0.0.0`, `--host`, `HOST=0.0.0.0`) — never localhost-only — so it's reachable. Report the LAN-IP URL, not the `localhost` one.
-
-## Persistent Configuration
-- Environment file: `~/.env.claude` (auto-loaded in shell sessions)
-- For Claude sessions, source it manually if needed: `source ~/.env.claude`
+@~/.claude/machine.md
 
 ## Browser automation
 - Use the `agent-browser` CLI (headless, via Bash) for anything browser-shaped: checking pages, dev servers, screenshots, form flows, console/eval. `agent-browser --help` lists commands; `snapshot` gives an accessibility tree with refs for AI use.
@@ -24,7 +16,7 @@
   just a URL — never start crit or any per-review server for code diffs.
 - Global hooks do the plumbing: SessionStart injects the review URL and full
   instructions in any rev-known repo, and a Stop hook prompts to (re)arm the
-  comment watcher (`~/tea/yolo/rev/scripts/rev-watch.sh <dir>`, background).
+  comment watcher (`~/tea/rev/scripts/rev-watch.sh <dir>`, background).
   Follow the injected instructions; there is nothing to set up.
 - The watcher is plumbing: arm and re-arm it silently, never announce its
   state (armed, exited, re-armed) in chat.