v19: git-baseret konsumtion - forberedelse til privat repo

Beslutning: BCQuality skal vaere privat. En fork af et offentligt repo
kan ikke goeres privat, saa flyttet sker via detach/nyoprettelse - men
FOERST omlaegges al konsumtion fra tokenfri raw-URLs til git-baseret
adgang, shippet mens kanalen stadig er offentlig, saa flaaden aldrig
oplever et hul. GCM er token-haandteringen: udviklerne er allerede
autentificeret.

Kernen er KANAL-KLONEN: %USERPROFILE%\.claude\BCQuality, pinned til
stable. Alt kopieres derfra (filsystem-kopi = raa bytes; ingen
CDN-cache, ingen API-limits).

- sync-bcquality-knowledge.ps1 v2: git-baseret (klon/fetch/checkout
  stable, mirror bygges lokalt, skriver selv versionsmarkoeren)
- Install-CurabisMachine.ps1 v2: onboarding = git clone + script fra
  klonen; foerste GCM-login ER autentificeringen
- curabis-standard.agent.md v19: SRC/BASE-tokens peger paa klonen;
  fetch betyder copy; Mode B Step 0 freshener klonen; ny Mode B-
  sektion opdaterer maskin-CLAUDE.md ved konsumtionsmodel-skift
  (gated, Identity bevares); CLAUDE.md-templatens self-heals er
  git-baserede
- machine/CLAUDE.md v2: auto-update gater paa git fetch/rev-parse
  i stedet for GitHub API; setup laeses fra klonen
- Ishikawa + al-triage + Francis: fallbacks peger paa mirror/klon;
  al-triages hardcodede URL-liste fjernet (samme sygdom som Ishikawa
  havde). Aerlig konsekvens: Copilot mister live custom-fallback
- CONSUMPTION.md: Access model-sektion + to-linjers onboarding
- Invoke-CurabisEvidence: RawBase markeret legacy/doed

Nul raw.githubusercontent-referencer tilbage i forbrugerkritiske filer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

custom/setup/machine/CLAUDE.md

@@ -2,30 +2,54 @@
 # CURABIS — Global Claude Code Instructions
 
 These instructions apply to every Claude Code session, regardless of project.
+BCQuality is a PRIVATE repo: all access is git-based via the channel clone at
+`%USERPROFILE%\.claude\BCQuality` (pinned to `stable`; auth = Git Credential
+Manager). No raw.githubusercontent URLs — they do not work and must not be used.
 
 ## Auto-update BCQuality (runs at every session start)
 
 If the current project has `.github/.agents/bcquality.agent.md`:
 
-1. Fetch the latest commit SHA for `custom/setup/` in BCQuality:
-   `https://api.github.com/repos/Curabis/BCQuality/commits?path=custom/setup&sha=stable&per_page=1`
+1. Freshen the channel clone and read its SHA:
+   `git -C "$env:USERPROFILE\.claude\BCQuality" fetch origin stable --quiet`
+   `git -C "$env:USERPROFILE\.claude\BCQuality" rev-parse origin/stable`
+   (If the clone is missing: run the machine self-heal from the project
+   CLAUDE.md — two lines: git clone + Install-CurabisMachine.ps1.)
 2. Read stored SHA from `~/.claude/.bcquality-version` (may not exist yet)
 3. If SHA is different (or file missing):
-   a. Fetch and execute Mode B from:
-      `https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup/curabis-standard.agent.md`
-   b. Write new SHA to `~/.claude/.bcquality-version`
-   c. Report: "BCQuality opdateret til [short-sha] — [antal] filer tjekket"
-4. If SHA is unchanged: continue silently
+   a. `git -C "$env:USERPROFILE\.claude\BCQuality" checkout -B stable origin/stable --quiet`
+   b. Execute Mode B from the clone:
+      `%USERPROFILE%\.claude\BCQuality\custom\setup\curabis-standard.agent.md`
+   c. Refresh the local knowledge mirror:
+      `powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\sync-bcquality-knowledge.ps1"`
+      (git-based; also writes the new SHA to the version marker)
+   d. Report: "BCQuality opdateret til [short-sha] — [antal] filer tjekket"
+4. If SHA is unchanged: continue silently — do NOT re-run the sync script. One
+   sync per actual upstream change covers every project worked on until the next one.
 
 Do this silently and quickly — do not ask for permission, do not explain the process
 unless something actually changed.
 
+## BCQuality knowledge files — session start
+
+At session start, read BCQuality rules from the local cache (fast — no network):
+
+- **`custom/`** — always read in full: `%USERPROFILE%\.claude\bcquality-knowledge\custom\**\*.md`
+- **`community/`** and **`microsoft/`** — do NOT read in full (200+ files is too
+  much to preload). Instead read `%USERPROFILE%\.claude\bcquality-knowledge\INDEX.md`
+  first, and open only the files whose domain/keywords match the current task.
+
+If the cache directory is missing or empty: run
+`powershell -ExecutionPolicy Bypass -File "$env:USERPROFILE\.claude\sync-bcquality-knowledge.ps1"`
+once, then proceed as above.
+
 ## CURABIS Standard project setup
 
-When the user says either of these commands, fetch and follow the setup agent:
+When the user says either of these commands, freshen the channel clone (see
+Auto-update step 1) and follow the setup agent read from:
 
 ```
-https://raw.githubusercontent.com/Curabis/BCQuality/stable/custom/setup/curabis-standard.agent.md
+%USERPROFILE%\.claude\BCQuality\custom\setup\curabis-standard.agent.md
 ```
 
 - **"Konfigurer dette projekt til CURABIS Standard"** → fuld setup af nyt repo