CLAUDE.md: replace the proxy env-var table with a pointer to README/ARCHITECTURE

[tonibergholm]

Summary

• Replace the 33-line proxy env-var table in CLAUDE.md with a two-line pointer to README.md and ARCHITECTURE.md, where the full table is maintained.
• Keeps the non-derivable contract in place: all vars optional, parsed fail-closed once at startup (malformed ⇒ FATAL), unset ⇒ documented default.

Why

The table duplicated documentation that already lives in README.md and ARCHITECTURE.md, costing ~670 est. tokens of always-loaded agent context per session and creating a third copy to keep in sync.

Testing

• Docs-only change; no code touched.

[github-actions]

Sentinel dependency audit — WARN · ✓ ok

137 allow · 12 warn · 0 block · 0 error
provenance: 41 verified · 0 invalid · 108 absent · 0 unknown

package	verdict	score	finding	how to fix
@sigstore/core@3.2.1	warn	76/100	Obfuscation: base64-decodes at runtime.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
@sigstore/verify@3.1.1	warn	52/100	Obfuscation: base64-decodes at runtime.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
depd@2.0.0	warn	60/100	Obfuscation: uses the Function constructor.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
esbuild@0.28.1	warn	62/100	install.js combines launch + write + read primitives — partial materialization pattern.	Review the finding details; approve with a recorded rationale only if you understand and accept the risk.
eventsource@3.0.7	warn	68/100	Network egress: makes an HTTP request.	Confirm the egress is expected for this package's purpose; if not, remove it or pin to a version without it.
iconv-lite@0.7.2	warn	56/100	Obfuscation: base64-decodes at runtime.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
isexe@2.0.0	warn	77/100	test/basic.js combines read + launch + write primitives — partial materialization pattern.	Review the finding details; approve with a recorded rationale only if you understand and accept the risk.
jose@6.2.3	warn	76/100	Obfuscation: base64-decodes at runtime.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
qs@6.15.2	warn	78/100	Obfuscation: char-code string assembly.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.
tsx@4.22.4	warn	76/100	dist/index-D9F1FXzN.cjs combines read + write primitives — partial materialization pattern.	Review the finding details; approve with a recorded rationale only if you understand and accept the risk.
undici-types@7.18.2	warn	56/100	Network egress: imports a raw networking module.	Confirm the egress is expected for this package's purpose; if not, remove it or pin to a version without it.
yaml@2.9.0	warn	62/100	Obfuscation: base64-decodes at runtime.	Inspect the source; obfuscation in a dependency is a red flag — prefer a readable, well-known alternative.

▶ Run sentinel explain <package> <version> for a suggested safe version and a ready waiver.

_{Sentinel · 149 packages audited · 2026-07-15T09:04:00.318Z · SBOM uploaded as a build artifact}