CLAUDE.md still described the bot exemption as identity-only (auto-passed unless a
protected path is touched). Since #698 it also requires EVERY changed path to be a
dependency manifest — a bot account does not attribute the code at a head. CLAUDE.md is
loaded every session, so a stale rule here is worse than a stale doc.
Refs: #698
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>