chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

server/internal/grpc/proxystream.go

@@ -45,7 +45,7 @@ func (s *vantageServer) ProxyStream(stream pb.Vantage_ProxyStreamServer) error {
 // testable without a real stream.
 //
 // The listener is bound here, on whichever replica the stream reached, rather
-// than in advance on the pod holding the agent's command stream — those are not
+// than in advance on the pod holding the agent's command stream - those are not
 // the same pod, because an L7 proxy balances HTTP/2 requests independently.
 func serveProxy(open *pb.ProxyOpen, instanceID string, stream proxy.AgentStream) error {
 	sess, err := services.ClaimProxyStream(instanceID, open.ServerId, open.ProxyId)

server/internal/grpc/server.go

@@ -168,7 +168,7 @@ func (s *vantageServer) ReportPackages(ctx context.Context, req *pb.ReportPackag
 //
 // It is not gated by licence: the workload registry reads as core fleet
 // management rather than a premium add-on. If that ever changes, the check
-// belongs here — gating collection, not display — for the same reason it does
+// belongs here - gating collection, not display - for the same reason it does
 // in ReportPackages.
 func (s *vantageServer) ReportWorkloads(ctx context.Context, req *pb.ReportWorkloadsRequest) (*pb.ReportWorkloadsResponse, error) {
 	srv, err := services.ValidateAgentToken(req.ServerId, req.AgentToken)
@@ -304,7 +304,7 @@ func (s *vantageServer) CommandStream(stream pb.Vantage_CommandStreamServer) err
 
 	// Serve claims this agent's presence on the bus and subscribes this pod to
 	// its command channel, so a dispatch issued by any other replica arrives
-	// here. The teardown releases both — an agent that reconnects to a
+	// here. The teardown releases both - an agent that reconnects to a
 	// different pod must not leave this one advertising a stream it no longer
 	// has.
 	ch, release := services.Dispatcher.Serve(stream.Context(), srv.ServerID)
@@ -422,7 +422,7 @@ const pingSummaryInterval = 5 * time.Minute
 // presence claim, released by a deferred call that a killed process never runs.
 // The claim then outlives its owner for the remainder of its 30s TTL, during
 // which dispatch believes the agent is reachable, publishes to a channel with
-// no subscriber, and fails as "agent offline" — a pod that has already exited
+// no subscriber, and fails as "agent offline" - a pod that has already exited
 // still answering for an agent it can no longer reach.
 func StartGRPC(port int) (stop func(), err error) {
 	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", port))
@@ -458,7 +458,7 @@ func StartGRPC(port int) (stop func(), err error) {
 	//
 	// It is bounded: an idle CommandStream returns as soon as its context is
 	// cancelled, but a console relay mid-transfer would otherwise hold the
-	// process past the pod's grace period and earn a SIGKILL — which is the
+	// process past the pod's grace period and earn a SIGKILL - which is the
 	// abrupt exit this exists to avoid.
 	return func() {
 		done := make(chan struct{})