CLAUDE.md forbids committing mj.config.cjs, but the repo tracks it and feature PRs edit it

**Found by** the PR gauntlet on #4231 (`fix/4209-provisioning-context-user`), 2026-09-04. Not caused by that PR — but that PR runs into it, so it is worth settling.

### Where
- `CLAUDE.md`, "Always-true facts" → *"**Never stage or commit local host artifacts**: Never commit
`mj.config.cjs`, `mj.config.json`, or generated host folders … to the repository."*
- `.gitignore:159-160` — ignores `mj.config.js` and `mj.config.ts`, but **not** `mj.config.cjs`
- `mj.config.cjs` at the repo root — tracked, and modified deliberately by `5fc861f67b`,
`048c5ce8c2` and `5dc4c6548f`

### What happens
The instruction says never commit the file. `git ls-files mj.config.cjs` returns it, `.gitignore`
does not cover the `.cjs` extension, and feature commits edit it on purpose — one of them
(`5dc4c6548f`) is literally *"chore: do not ship BizApps dynamicPackages in mj.config.cjs"*.

### Why it matters
An agent or a new contributor reading the rule literally will either refuse a correct template edit
or — worse — discount the rule entirely, because it is visibly already violated. That is the
failure that matters: the rule's *real* value is stopping a host-specific value (a port, an
`enabled` flag, a credential path) from being committed, and a rule known to be wrong stops being
read. This gauntlet run hit it twice: it had to flip `magicLink.enabled` to `true` as a test
fixture in a **tracked** file, and PR #4231 legitimately edits a comment in the same file.

There is no secret exposure — every credential in the file comes from `process.env`.

### Repro
```bash
git ls-files mj.config.cjs # -> mj.config.cjs (tracked)
git check-ignore -q mj.config.cjs; echo $? # -> 1 (not ignored)
grep -n "mj.config" .gitignore # -> only .js and .ts
git log --oneline -3 -- mj.config.cjs # -> deliberate feature edits
```

### Evidence
Raised as finding 1 by the adversarial reviewer during the #4231 gauntlet, at **high** severity,
precisely because a `git add -A` during that run would have shipped an unauthenticated public
route surface (`magicLink.enabled: true`) to everyone who pulled the branch.

### Suggested fix
Pick one and make the repo agree with it:

1. **The file is a committed template.** Narrow the `CLAUDE.md` wording to say so, and that a PR
must not change its *host-specific values*. Back it with a gate script that fails when a PR's
diff to `mj.config.cjs` touches anything but comments and documented template defaults.
2. **The file is a host artifact.** Add `mj.config.cjs` to `.gitignore`, ship the template as
`mj.config.example.cjs`, and have `mj dev workspace` copy it on first run.

Option 1 matches what the repo actually does today.

### Definition of done
- [ ] `CLAUDE.md` and the repo's behaviour agree
- [ ] A gate enforces whichever rule is chosen, rather than prose alone
- [ ] `npm run check:claude-md` and `npm run check:standards` green

### Verify by
Flip a host-specific value in `mj.config.cjs`, stage it, and confirm the chosen gate rejects it —
while a comment-only edit passes.

Review CLAUDE.md, .gitignore, mj.config.cjs, and the existing npm checks named in the definition of done. Decide how the tracked configuration should be treated, then make the documentation and repository behavior agree and add the requested gate. Verify that a host-specific value is rejected while a comment-only edit passes, with npm run check:claude-md and npm run check:standards green.

Written by the indexing model from the issue text.