docs(CLAUDE): tighten prose and correct the manifest-delivery claim

Follow-up to 73970cf3. Two improvements:

- Corrects a stale claim — manifests are no longer "loaded from disk, goal is
  the catalog". The signed catalog has been the delivery mechanism since
  2026-06-23 (origin-wins over disk), so the guide states that, plus the
  consequence contributors need: editing a disk manifest alone does not change
  a catalog-covered app.
- Tightens the north-star paragraph.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -7,10 +7,9 @@ design docs live. The authoritative behaviour is always the code in `core/`.
 **Read [`docs/ROADMAP.md`](docs/ROADMAP.md) for where the project is going** and
 [`docs/README.md`](docs/README.md) for the full documentation index.
 
-The north star: a world-class, **developer-ready app platform** where every app
-is manifest-driven, manifests ship via the **signed registry** (not disk files),
-and **third-party developers publish apps via an external/decentralized
-registry** — all rootless, secure, robust, and 100%-uptime-capable.
+The north star: a world-class, **developer-ready app platform** — every app
+manifest-driven, rootless, secure, and 100%-uptime-capable, with third-party
+developers publishing via an external/decentralized registry.
 
 Detailed sub-plans:
 - App platform / packaging phases + security model → [`docs/APP-PACKAGING-MIGRATION-PLAN.md`](docs/APP-PACKAGING-MIGRATION-PLAN.md)
@@ -58,8 +57,10 @@ lost by sitting uncommitted in a shared tree across sessions. To prevent that:
 - Frontend: `neode-ui/` → `npm run build` outputs to `web/dist/neode-ui/`.
   Grep the built bundle for new strings before shipping (the build can silently
   no-op).
-- App manifests load from disk on nodes at `/opt/archipelago/apps/*/manifest.yml`
-  today; the goal is to distribute them via the signed catalog instead.
+- App manifests are delivered inside the **signed catalog** (`releases/app-catalog.json`),
+  whose entry overrides the on-disk `/opt/archipelago/apps/*/manifest.yml`
+  (origin-wins; disk is the fallback). Editing a disk manifest alone does **not**
+  change a catalog-covered app — regenerate and re-sign the catalog.
 
 ## Production test gate (definition of done)