Rename the project spec and update every reference to it

The charter file carried a tool-specific name while being the repository's own
document: mission, non-negotiable constraints, the pinned stack, repo
conventions and phase status, cited as authority by thirty files across the
agent, api, deploy, docs, search and terraform trees.

PROJECT-SPEC.md says what it is. All 42 references are updated in the same
commit, including the relative link in docs/status.md, so nothing points at a
filename that no longer exists.

docs/architecture.md

@@ -65,7 +65,7 @@ one instead of deferring it, and keeps Kafka credentials off the edge agent.
   family isn't a fit for this (no real row-level locking/transactional
   read-modify-write).
 
-This split is not to be changed without discussion — see CLAUDE.md.
+This split is not to be changed without discussion — see PROJECT-SPEC.md.
 
 ## Component responsibilities
 
@@ -213,7 +213,7 @@ both the Helm and docker-compose layers, the two provisioning
 mechanisms unified, both storage engines' write paths per-tenant-routed,
 and the tenant-picker frontend page now built and browser-verified
 (`web/src/routes/select-tenant`, `api/httpserver.WithCredentialedCORS`
-— see `/CLAUDE.md`'s Phase 4 section and `/web/README.md`'s "Tenant
+— see `/PROJECT-SPEC.md`'s Phase 4 section and `/web/README.md`'s "Tenant
 picker" section), the remaining gaps in this phase are entirely the
 already-disclosed live-verification caveats: the ClickHouse/Postgres-
 backed pieces have never run against a real database in this
@@ -244,18 +244,18 @@ plain HTTP instead (`api/authz.HTTPAuthorizer`, `web`'s
 `GET /auth/features`) — the same "network boundary, not import boundary"
 shape `/alerting`↔`api` already used before `enterprise/` existed.
 
-## Non-negotiables carried from CLAUDE.md
+## Non-negotiables carried from PROJECT-SPEC.md
 
 - Rust agent: statically linked musl, `x86_64-unknown-linux-musl` and
   `aarch64-unknown-linux-musl`, no glibc runtime deps.
 - Windows support via native ETW/Event Log API, not WSL — designed
   (Phase 1) but still unverified on real Windows hardware.
 - Every UI action maps to a documented REST/gRPC call — no UI-only logic.
-- Pinned stack (see CLAUDE.md table) — no substitutions without discussion.
+- Pinned stack (see PROJECT-SPEC.md table) — no substitutions without discussion.
 
 ## Explicitly out of scope (current, Phase 4)
 
-Per `/CLAUDE.md`'s Phase 4 non-goals and `/docs/security/threat-model.md`:
+Per `/PROJECT-SPEC.md`'s Phase 4 non-goals and `/docs/security/threat-model.md`:
 deny-override permission grants, a data retention/deletion policy for
 deprovisioned tenants, general multi-cluster orchestration in `/deploy`,
 and any defense against a privileged ClickHouse/Postgres administrator —

docs/compliance/license-audit-report.md

@@ -221,7 +221,7 @@ Key facts, verified against primary sources:
    already speak. Real tradeoff: Redpanda was originally chosen partly
    for its lightweight single-binary footprint (`docker-compose.yml`
    runs it with `--smp=1 --memory=1G --overprovisioned`, tuned for a
-   resource-constrained local/homelab deployment per `CLAUDE.md`'s
+   resource-constrained local/homelab deployment per `PROJECT-SPEC.md`'s
    stated deployment targets); Kafka's JVM-based broker has a materially
    larger minimum memory/startup footprint. This is a real regression
    for the project's stated "docker-compose for local/homelab" use case,
@@ -263,7 +263,7 @@ project's own logo package.
 
 **Before this audit**: no root `LICENSE` file existed anywhere in the
 repo — not at the root, not in `enterprise/`. The only license
-declarations were prose statements in `CLAUDE.md`/`docs/architecture.md`
+declarations were prose statements in `PROJECT-SPEC.md`/`docs/architecture.md`
 and correct `license = "AGPL-3.0-only"` fields in the two Rust
 workspaces' `Cargo.toml`s. `web/package.json` had no `license` field at
 all (npm's tooling reported the package itself as `UNLICENSED` as a
@@ -324,10 +324,10 @@ assumed.
 - Every prose reference to `enterprise/` as "commercial license" or
   "commercial-licensed" across the repo was updated. Present-tense
   claims (code comments, `README.md` files describing current state,
-  `CLAUDE.md`'s non-negotiable constraints) were corrected outright.
+  `PROJECT-SPEC.md`'s non-negotiable constraints) were corrected outright.
   Historical, phase-specific documents (`docs/phase-4-isolation-design.md`,
   `docs/phase-4-rbac-design.md`, `docs/phase-4-runbook.md`, and the
-  relevant parts of `CLAUDE.md`'s and `docs/architecture.md`'s Phase 4
+  relevant parts of `PROJECT-SPEC.md`'s and `docs/architecture.md`'s Phase 4
   sections) were given forward-pointing corrections — "commercial
   license at the time this was written; AGPLv3 as of Phase 6" — rather
   than rewritten as if the commercial-license period never happened,
@@ -400,7 +400,7 @@ Redpanda decision below, every item has one.
 
 **Every task-2 (c)/unresolved-(b) item now has an explicit resolution**
 — fixed, isolated, or, for Redpanda, flagged and decided. Phase 6's exit
-criteria in `CLAUDE.md` are updated accordingly.
+criteria in `PROJECT-SPEC.md` are updated accordingly.
 
 ## Legal disclaimer (repeated, deliberately)
 

docs/phase-1-runbook.md

@@ -72,7 +72,7 @@ curl -X POST http://localhost:8080/search -H 'Content-Type: application/json' \
 ```
 
 **The `record_id` in both responses should match.** That's the actual
-Phase 1 exit criterion (`/CLAUDE.md`) for the Linux half: the same
+Phase 1 exit criterion (`/PROJECT-SPEC.md`) for the Linux half: the same
 record, reachable both ways. If `/search` returns nothing yet, give it a
 few more seconds — Tantivy commits on a timer (`COMMIT_INTERVAL_MS`,
 default 2s), so there's a small window where a record is in ClickHouse

docs/phase-2-runbook.md

@@ -97,7 +97,7 @@ not a projection):
 | `SELECT count() FROM logs WHERE service='web'` (raw SQL) | Pure ClickHouse | 17.5ms |
 
 All four "well under a second" — the Phase 2 exit criteria in
-`/CLAUDE.md`. The combined text+aggregation case (the one everyone should
+`/PROJECT-SPEC.md`. The combined text+aggregation case (the one everyone should
 be nervous about, since it's a two-backend query) came in at 46ms, not
 meaningfully slower than the pure-ClickHouse case — the Tantivy prefilter
 step is fast, and 5,000 UUIDs (see below) is a small `IN` clause by

docs/phase-3-dashboard-design.md

@@ -1,6 +1,6 @@
 # Dashboard design
 
-> **Status:** Approved, in progress. Task 2 of Phase 3 — see `/CLAUDE.md`'s
+> **Status:** Approved, in progress. Task 2 of Phase 3 — see `/PROJECT-SPEC.md`'s
 > "What done looks like for Phase 3" section for the exit criteria this is
 > built against. Task 3 (dashboard CRUD API + web UI) implements this
 > doc; if implementation reveals this design is wrong somewhere, fix this
@@ -24,7 +24,7 @@ saved query itself.
 ## Why not ClickHouse: PostgreSQL for control-plane config
 
 This phase adds PostgreSQL as a new pinned-stack component — flagged and
-confirmed with the project owner before implementation, per CLAUDE.md's
+confirmed with the project owner before implementation, per PROJECT-SPEC.md's
 "ask before... making an architectural decision not already specified in
 `/docs/architecture.md`." Scope is strictly control-plane config
 (dashboards, panels, and — per `/docs/phase-3-alerting-design.md` —

docs/phase-4-isolation-design.md

@@ -37,7 +37,7 @@ ships entirely in `enterprise/`, not AGPL core. Core (`/api`,
 `/alerting`, `/web`) stays genuinely single-tenant: no multi-tenant
 mechanism present at all, not merely a missing management UI on top of
 otherwise-functional isolation. This was an explicit choice put to the
-project owner rather than assumed, because CLAUDE.md's licensing
+project owner rather than assumed, because PROJECT-SPEC.md's licensing
 boundary text names multi-tenancy as enterprise-gated, and a
 "mechanism in core, feature in enterprise" split would have let a
 sufficiently motivated self-hosting AGPL user wire up real isolation

docs/phase-7-ai-design.md

@@ -61,7 +61,7 @@ Design choices worth calling out explicitly:
 | Hardware floor | Runs on CPU (slow) or a single consumer GPU via quantized (GGUF) models | Needs a real GPU; not practically CPU-viable |
 | Deployment complexity | Single binary/container, `ollama pull <model>`, built-in REST API | Python server, CUDA/driver management, more moving parts |
 | Throughput under concurrency | Adequate for one-user-at-a-time interactive use; not built for high concurrent QPS | Purpose-built for high-throughput serving (continuous batching, PagedAttention) |
-| Fit for this project | Matches `docker-compose for local/homelab` (CLAUDE.md's stated deployment target) — most self-hosters won't have a dedicated inference GPU | Fits a provisioned-GPU SaaS inference tier — not this phase's target (cloud is the opt-in secondary path, not primary) |
+| Fit for this project | Matches `docker-compose for local/homelab` (PROJECT-SPEC.md's stated deployment target) — most self-hosters won't have a dedicated inference GPU | Fits a provisioned-GPU SaaS inference tier — not this phase's target (cloud is the opt-in secondary path, not primary) |
 
 Cairn OBS's actual AI workload shape is one interactive query bar per user
 at a time, not a high-QPS inference-serving problem — vLLM's real

docs/security/threat-model.md

@@ -495,7 +495,7 @@ handler to call them from).
 
 ## Known residual risks (explicitly out of scope, not silently assumed away)
 
-Per `/CLAUDE.md`'s Phase 4 non-goals, restated here in threat-model
+Per `/PROJECT-SPEC.md`'s Phase 4 non-goals, restated here in threat-model
 terms:
 
 - **A privileged ClickHouse/Postgres administrator is not defended

docs/status.md

@@ -2,7 +2,7 @@
 
 Phase-by-phase record of what was built, what "done" meant for each phase,
 and how it was verified. Conventions and constraints live in
-[`/CLAUDE.md`](../CLAUDE.md); the architecture spec is
+[`/PROJECT-SPEC.md`](../PROJECT-SPEC.md); the architecture spec is
 [`/docs/architecture.md`](architecture.md).
 
 Each phase has a runbook in this directory recording the actual