chore: replace em dashes with hyphens, add no-em-dash rule to CLAUDE.md

backup/verify.go

@@ -109,8 +109,8 @@ func probe(ctx context.Context, opt VerifyOptions, rep *VerifyReport) error {
 		rep.ProbeDecrypted = true
 		return nil
 	}
-	// No ciphertext anywhere is an ordinary state — a deployment that has
-	// stored no secrets, keys or SSO configuration yet — and is not a failure.
+	// No ciphertext anywhere is an ordinary state - a deployment that has
+	// stored no secrets, keys or SSO configuration yet - and is not a failure.
 	return nil
 }
 
@@ -121,13 +121,13 @@ func probe(ctx context.Context, opt VerifyOptions, rep *VerifyReport) error {
 // This map MIRRORS BY HAND the bson tags in server/internal/models, which this
 // package cannot import: shared/ is a separate module and models is under
 // server/internal. It must change in the same commit as any rename of the
-// fields below — the same mirrored-constant hazard as web/lib/targets.ts and
+// fields below - the same mirrored-constant hazard as web/lib/targets.ts and
 // services.MaxWorkloadLogLines. The sources are:
 //
-//	keys             — models/key.go: private_key_enc, passphrase_enc
-//	secrets          — models/secret.go: encrypted_value
-//	auth_providers   — models/auth_provider.go: client_secret_enc
-//	console_sessions — models/console_session.go: rdp_user_enc, rdp_pass_enc
+//	keys             - models/key.go: private_key_enc, passphrase_enc
+//	secrets          - models/secret.go: encrypted_value
+//	auth_providers   - models/auth_provider.go: client_secret_enc
+//	console_sessions - models/console_session.go: rdp_user_enc, rdp_pass_enc
 //
 // settings is deliberately absent: it holds no ciphertext at all. The ESO read
 // token is stored as a SHA-256 hash, which no key opens.