docs: committing is not publishing — origin is a pushable bare repo

This file said `origin` was fetch-only and that committing locally published
via gitsite. That stopped being true when `~/.local/bin/git-bare-sync.sh` added
the bare layer: `origin` is the local bare repo `~/git/cce-authenticator.git`, a
real pushable remote, and the old static mirror
`https://git.lucas.co/cce-authenticator.git` is demoted to the `published` remote —
it never accepted a push (dumb HTTP, no receive-pack), which is the whole reason
the bare layer exists.

Acting on the stale wording leaves work that looks published on this machine and
is not on the site. That gap was workspace-wide on 2026-09-18: 21 crates held
unpushed commits, because the bulk pusher read `repos.conf` field 2 as a work
tree when that field holds the bare path, and skipped all 34 repos in silence.

The chain is `git commit` → `git push origin main` → `gitsite.timer` → the site.

Matches the wording already corrected in cce-compositor/WORKSPACE.md and
cce-remote/CLAUDE.md.

Co-Authored-By: Claude Opus 5 <[email protected]>

 CLAUDE.md | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 8383acf..e617a84 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -136,6 +136,9 @@ and stranded dialogs. The crate's one test locks those orderings in.
 
 `make install` → `ccebuild install --no-build cce-authenticator`, which installs the
 binary *and* `cce-polkit-agent.service`. Never hand-list binaries in the Makefile —
-`cargo metadata` already knows them. This directory is its own git repository with a
-fetch-only origin; committing locally is publishing, via gitsite. `Cargo.lock` is
-gitignored here, so it needs no refresh when dependencies change.
+`cargo metadata` already knows them. This directory is its own git repository whose
+`origin` is the local *bare* repo `~/git/cce-authenticator.git`, a real pushable
+remote: **committing is not publishing — `git push origin main` is**, after which
+`gitsite.timer` mirrors it to `https://git.lucas.co/cce-authenticator.git` (kept as the
+`published` remote; it is the old static mirror and never accepted a push).
+`Cargo.lock` is gitignored here, so it needs no refresh when dependencies change.