chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

server/internal/vulnsched/sched.go

@@ -101,7 +101,7 @@ func (s *scheduler) tick(ctx context.Context) {
 }
 
 // ensureDB pulls a fresh database when the local copy is stale, and marks the
-// whole fleet for rescanning when the version changes — which is what makes a
+// whole fleet for rescanning when the version changes - which is what makes a
 // newly published CVE flag existing servers within a minute rather than at the
 // next agent report.
 func (s *scheduler) ensureDB(ctx context.Context) error {
@@ -188,7 +188,7 @@ func (s *scheduler) scanPending(ctx context.Context) {
 	for _, sp := range pending {
 		if ctx.Err() != nil {
 			// Leadership lost. scan_pending is still set, so the next leader
-			// picks these up — which is why it lives on the document.
+			// picks these up - which is why it lives on the document.
 			return
 		}
 		opened := s.scanOne(ctx, sp, meta)
@@ -215,7 +215,7 @@ func (s *scheduler) scanOne(ctx context.Context, sp models.ServerPackages, meta
 	results, err := vulndb.Match(s.store, sp.OS, sp.Packages)
 	if err != nil {
 		// We hold no feed for this distribution, so we cannot answer whether it
-		// is vulnerable. Say "unsupported" — reporting zero findings here would
+		// is vulnerable. Say "unsupported" - reporting zero findings here would
 		// be indistinguishable from reporting a clean host, and one of those is
 		// a lie.
 		status := models.ScanStatusUnsupported