Dependabot minimum release age and auto-merge — the trap in a private repo
On a private repo the dependency graph is off by default, so Dependabot opened no npm pull request, and the auto-merge workflow merged 45s before CI finished.
Automation
CLAUDE_PROJECT_DIR let me move my glossary out of a Claude Code skill — and stop approving every write
Claude Code treats .claude/ as a protected path, so allow rules cannot pre-approve writes there. Moving a mutable glossary out with CLAUDE_PROJECT_DIR.