CLAUDE.md: Topologie-Ausnahme fuer Rotations-PRs + .gitlab-ci.yml in Struktur

Der TURN-Rotations-CronJob erreicht git.lab nicht und oeffnet seinen PR
weiter auf Gitea - dokumentiert, wie er kanonisch zu mergen ist
(Beispiel 640c934 vom 2026-08-01), inkl. Mirror-Force-Sync-API.
Karpathy-Guidelines unveraendert.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PKhFj1S3UdD6xL2fbWPeYj

CLAUDE.md

@@ -31,10 +31,18 @@ force-overwrites divergent state. Issues/wiki/releases stay on Gitea. The same r
 applies to ThreadNet-Web, threadnet-call, thread-net-git and threadnet-operating; only
 the `Backlogs` repo (and this repo's wiki) are still direct-to-Gitea.
 
+**Exception that needs manual handling**: the monthly TURN-rotation CronJob runs in the
+cluster (no route to git.lab) and still opens its PR on Gitea. Never merge that PR on
+Gitea — instead fetch the rotation branch, merge it into main locally, push to git.lab;
+the mirror carries it back, Gitea auto-closes the PR (worked example: 2026-08-01,
+commit 640c934). If the mirror lags, force it: GitLab API
+`POST /projects/<id>/remote_mirrors/<mirror_id>/sync`.
+
 ## Repository Structure
 
 ```
 gitops/
+├── .gitlab-ci.yml            # Lab-CI verify job (YAML validation + SOPS-encryption check)
 ├── clusters/matrix/          # Flux GitRepository definition; entry point for reconciliation
 ├── apps/
 │   ├── base/