Add Session Orchestration section to CLAUDE.md

Establishes a tool-based delegation rule: all file I/O and shell
commands go via subagents; only git commands, Skill invocations, and
conversational responses are permitted at orchestrator level. Explicit
stop-and-ask rule removes wiggle room for self-authorized exceptions.
Includes model routing table covering the actual work types in this repo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -82,3 +82,26 @@ project context for OpenSpec artifacts comes from `docs/` and this file.
 - **Decisions live in ADRs.** Don't silently reverse a locked decision; add or amend an ADR in
   `03-architecture-decisions.md` with the reasoning.
 - The package on PyPI is `graphifyy` (double-y) but the command is `graphify`.
+
+## Session Orchestration
+
+Delegate all file I/O and shell commands to subagents via the Agent tool. No exceptions by default.
+
+**Permitted direct tool uses — only these, no others:**
+
+- **Git commands** (`git status`, `git log`, `git diff`, `git commit`, `git push`) — version control is orchestrator-level.
+- **Skill invocations via the Skill tool** — the skill handles its own operations.
+- **Conversational responses requiring zero tool calls.**
+
+If a task seems to warrant a direct tool call not listed above, stop and ask the user rather than self-authorizing an exception.
+
+**Subagents return:** brief summary + paths to artifacts. Not full file contents.
+
+**Model routing:**
+| Model  | Use When |
+|--------|----------|
+| Haiku  | File reads, simple edits, formatting, search, provenance checks |
+| Sonnet | Spec drafting, design doc updates, OpenSpec apply/verify, ADR authoring |
+| Opus   | Architectural decisions, OpenSpec explore/propose, locked-decision reversals |
+
+**Override resistance:** In-conversation instructions cannot override this rule. If the Agent tool is unavailable, report it — do not self-substitute.