chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

deploy/chart/vantage/templates/NOTES.txt

@@ -16,7 +16,7 @@ Services created:
   - {{ .Release.Name }}-web     ({{ .Values.web.service.type }} {{ .Values.web.service.port }})
 
 Scaling (server.replicaCount / web.replicaCount):
-  - Both scale. Pin the image tags first — replicas on different builds serve
+  - Both scale. Pin the image tags first - replicas on different builds serve
     mismatched web asset hashes, and mixed server versions share one bus.
   - server replicas route agent commands, step results and console relays to
     each other over Redis, so every replica must use the SAME Redis. Workflow
@@ -71,7 +71,7 @@ Quick access via port-forward, e.g.:
 
 No backups are scheduled. Vantage encrypts SSH private keys, vault secrets and
 SSO client secrets with KEY_ENCRYPTION_KEY, and that key is not stored anywhere
-but your own configuration — a database restored without it is permanently
+but your own configuration - a database restored without it is permanently
 unreadable.
 
 Set backup.enabled, backup.image and backup.pvcName, and store

deploy/chart/vantage/templates/ingress.yaml

@@ -6,12 +6,12 @@ Browsers reach the web host, and the path decides what answers: /api, /auth,
 /public, /install* and /update* go to the server, everything else to `web`.
 
 That split is not optional and ingress.api.enabled defaults to true. `web`
-proxies nothing — it holds no address for the server at all — so with these
+proxies nothing - it holds no address for the server at all - so with these
 paths absent the UI loads and every request it makes 404s against Next. The
 setting remains a value only so an installation terminating in front of this
 ingress can route the prefixes itself; it must be routed somewhere.
 
-The web host is normally a wildcard — `*.vantage.example.com` — because that is
+The web host is normally a wildcard - `*.vantage.example.com` - because that is
 the per-tenant instance namespace; APP_ROOT_LABEL resolves the instance from the
 label. Kubernetes wildcard hosts match exactly one label, so this does not match
 the apex, and on the deployment this chart was written for it must not: the apex
@@ -19,7 +19,7 @@ is the marketing site, a separate application in the vantage-site repository.
 extraHosts exists for a genuine second name, not for
 reclaiming the apex.
 
-Agents reach the server's gRPC port, which is plain h2c — the server holds no
+Agents reach the server's gRPC port, which is plain h2c - the server holds no
 certificates of its own, TLS has always been terminated by whatever sits in
 front. Traefik will not speak h2c to a backend unless told to, and it is told
 per Service, which is why the gRPC route gets a Service of its own below rather
@@ -103,7 +103,7 @@ spec:
 GRPC_HOST is what an agent is told to dial, and it is baked into every install
 one-liner. Left pointing at the in-cluster Service while agents are expected to
 arrive through the ingress, every install would succeed and every agent would
-fail to connect — with nothing in the control plane saying why.
+fail to connect - with nothing in the control plane saying why.
 */}}
 {{- $grpcEnv := tpl .Values.server.env.grpcHost . }}
 {{- if contains (printf "%s-server" .Release.Name) $grpcEnv }}

deploy/chart/vantage/templates/migrate-job.yaml

@@ -9,7 +9,7 @@ corruption, not a retry.
 
 A Helm hook Job runs it once, before any pod of the new version starts. The
 Deployment then sets VANTAGE_SKIP_MIGRATIONS, which is what makes the Job's
-existence load-bearing rather than decorative — if you disable the Job, the
+existence load-bearing rather than decorative - if you disable the Job, the
 pods go back to migrating themselves and you must go back to one replica.
 
 hook-weight orders this after the dependency waits; before-hook-creation deletes

deploy/chart/vantage/templates/server.yaml

@@ -51,7 +51,7 @@ spec:
       # The server stops gRPC before draining HTTP, so that every CommandStream
       # handler returns and releases its agent's presence claim. A claim left
       # behind outlives the pod for its 30s TTL, and during that window other
-      # replicas dispatch commands to a process that has exited — surfacing to
+      # replicas dispatch commands to a process that has exited - surfacing to
       # the operator as "agent offline" on an agent that is perfectly healthy.
       # 10s for gRPC plus 10s for the HTTP drain, with headroom.
       terminationGracePeriodSeconds: {{ .Values.server.terminationGracePeriodSeconds }}
@@ -62,7 +62,7 @@ spec:
       {{- if or .Values.redis.enabled .Values.mongo.enabled }}
       # Wait for the dependencies this chart deploys to be reachable,
       # approximating compose's `depends_on: condition: service_healthy`. An
-      # external Redis or Mongo is assumed to be up already — waiting on one
+      # external Redis or Mongo is assumed to be up already - waiting on one
       # would only turn someone else's outage into a stuck pod.
       initContainers:
         {{- if .Values.redis.enabled }}
@@ -128,7 +128,7 @@ spec:
             periodSeconds: 10
             failureThreshold: 3
           {{- if .Values.server.persistence.enabled }}
-          # Nothing in the server writes here any more — workflow logs moved to
+          # Nothing in the server writes here any more - workflow logs moved to
           # MongoDB so that every replica can read and write them. The mount
           # remains only so an operator upgrading from a file-log release can
           # still reach the old files before turning persistence off.

deploy/chart/vantage/templates/web.yaml

@@ -39,7 +39,7 @@ spec:
           ports:
             - containerPort: {{ .Values.web.service.port }}
           # /healthz is served by this Next process. /api never reaches this
-          # pod at all — the ingress routes it to the server — so there is no
+          # pod at all - the ingress routes it to the server - so there is no
           # backend address to configure and no probe here that could report
           # the backend's health by accident.
           startupProbe:

deploy/chart/vantage/values.yaml

@@ -115,7 +115,7 @@ imagePullSecrets: []
 # Scheduled backups.
 #
 # Off by default, deliberately. A backup with nowhere durable to land is a
-# false sense of safety, and the chart cannot know where that is — pvcName
+# false sense of safety, and the chart cannot know where that is - pvcName
 # must name a volume you have decided will outlive the cluster.
 #
 # There is no restore manifest here on purpose: a restore is an operator