chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

server/internal/models/api_token.go

@@ -10,7 +10,7 @@ import (
 //
 // The plaintext is shown once at creation and never stored: only TokenHash,
 // which is sha256 hex of the value, exactly as servers.agent_token_hash and the
-// ESO read token already are. bcrypt is deliberately not used — the value is
+// ESO read token already are. bcrypt is deliberately not used - the value is
 // full-entropy random rather than a chosen password, and a per-token salt would
 // force a collection scan where an indexed lookup is wanted.
 //

server/internal/models/channel.go

@@ -22,7 +22,7 @@ const RedactedSecret = "••••••••"
 // channelSecretKeys names, per channel type, the config entries that are
 // credentials rather than settings. A Slack or Discord webhook URL is on this
 // list because possession of the URL *is* the authorisation to post to that
-// channel — there is nothing else to steal.
+// channel - there is nothing else to steal.
 var channelSecretKeys = map[string][]string{
 	ChannelWebhook:  {"url"},
 	ChannelSlack:    {"url"},

server/internal/models/monitor.go

@@ -23,8 +23,8 @@ const RunnerServer = "server"
 
 // RunnerRestricted replaces a monitor's runner in an API response when the
 // real value is a server ID the acting token's scope does not admit. The
-// monitor itself is still returned — a restricted operator may legitimately
-// need to see its name and state — only where it runs is hidden, the same
+// monitor itself is still returned - a restricted operator may legitimately
+// need to see its name and state - only where it runs is hidden, the same
 // way a workflow's target list can omit an ID without the whole workflow
 // disappearing from a list.
 const RunnerRestricted = "restricted"

server/internal/models/vuln.go

@@ -63,7 +63,7 @@ type VulnFinding struct {
 	PackageName string `bson:"package_name" json:"package_name"`
 	Installed   string `bson:"installed_version" json:"installed_version"`
 	// FixedIn empty means no vendor fix has been published. That is a real and
-	// common state and must never be conflated with "not vulnerable" — it is
+	// common state and must never be conflated with "not vulnerable" - it is
 	// the finding most in need of acceptance, since there is nothing to patch.
 	FixedIn    string   `bson:"fixed_in,omitempty" json:"fixed_in,omitempty"`
 	Severity   string   `bson:"severity" json:"severity"`