docs: name the gate, since running a lookalike is what broke the build

`npx tsc --noEmit` and `npx vite build` pass code that `pnpm build` rejects: the
first resolves a different project graph, the second type-checks nothing. Write
down the commands the workflow actually runs so the next person runs those.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Jp6a8EDar9ueEhAxzep4V5

CLAUDE.md

@@ -557,6 +557,28 @@ Never `corepack enable`; pnpm is already on PATH (`gitea-runners.md` §4).
 negotiates h2, where the `Connection: Upgrade` handshake is not how WebSockets
 work — you get a 400 from axum that looks like a proxy misconfiguration.
 
+## Run the gate CI runs, not one that looks like it
+
+Before pushing, from `web/`:
+
+```sh
+pnpm format:check && pnpm lint && pnpm build
+```
+
+`pnpm build` is `tsc -b && vite build`. **`npx tsc --noEmit` is not a substitute**
+— it resolves a different project graph — and `vite build` type-checks nothing at
+all, so the pair of them passes code that CI rejects. That is exactly how
+`Type '"" | Window | null' is not assignable` reached a build.
+
+The Rust half, likewise verbatim:
+
+```sh
+cargo fmt --all -- --check
+SQLX_OFFLINE=true cargo clippy --all-targets --all-features -- -D warnings
+SQLX_OFFLINE=true cargo test --all
+git status --porcelain web/src/api/generated/   # must be empty: the drift gate
+```
+
 ## Verifying a change
 
 `systemctl is-active` is not evidence this works. A daemon with a node it cannot