chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

web/components/vulnerabilities/DBFreshness.tsx

@@ -7,7 +7,7 @@ import { ageHours, relativeTime } from "./SeverityVisuals";
  * A fleet scanned against a three-week-old database must say so where its
  * findings are read. Quietly reporting "0 open" against stale data is the same
  * class of lie as reporting zero findings for a distribution we hold no feed
- * for — it looks exactly like good news.
+ * for - it looks exactly like good news.
  */
 
 // Past this the banner stops being informational and starts being a warning.

web/components/vulnerabilities/PackageRow.tsx

@@ -37,7 +37,7 @@ export function PackageRow({ group, serverName, canAct, onAccept, onUnaccept, on
 
     return (
         // A row inside the page's one bordered container, not a card of its
-        // own — the same stack idiom as the monitors and workflows lists.
+        // own - the same stack idiom as the monitors and workflows lists.
         <div className="border-t border-border-soft first:border-t-0">
             <button
                 onClick={() => setOpen((v) => !v)}

web/components/vulnerabilities/ServerVulnerabilities.tsx

@@ -58,7 +58,7 @@ export function ServerVulnerabilities({ serverId }: { serverId: string }) {
                         <p className="text-sm text-warning">
                             {pkg.os.family} {pkg.os.version_id} has no advisory feed, so this server cannot be scanned.
                         </p>
-                        <p className="mt-1 text-xs text-text-tertiary">This is not the same as having no vulnerabilities — it means we cannot answer the question for this distribution.</p>
+                        <p className="mt-1 text-xs text-text-tertiary">This is not the same as having no vulnerabilities - it means we cannot answer the question for this distribution.</p>
                     </>
                 ) : (
                     <>

web/components/vulnerabilities/VulnAlertRulesCard.tsx

@@ -62,7 +62,7 @@ export function VulnAlertRulesCard() {
                 <div>
                     <h2 className="text-base font-bold tracking-[-0.02em] text-text-primary">Vulnerability alerts</h2>
                     <p className="mt-0.5 text-sm text-text-secondary">
-                        One digest per rule per scan, summarising what newly opened — never one message per finding.
+                        One digest per rule per scan, summarising what newly opened - never one message per finding.
                     </p>
                 </div>
                 {!adding && (