claude-code: point the agent at the mesh's tools and guard its shell against ssh to the mesh (hq ADR 0245)

The agent kept running ssh <machine> journalctl while the journal verb existed. The managed
instructions now carry an "instead of" table generated from what each verb says it replaces, and
the plugin carries a PreToolUse guard that refuses ssh to a mesh machine and local work-arounds for a
mesh name, naming the tool or saying one must be created. The operator's override is read from the
session's start environment and recorded.

modules/claude-code/module.json

@@ -22,6 +22,7 @@
   "tools": [
     "claude_code_status",
     "claude_code_render",
+    "claude_code_guard",
     "claude_code_pull",
     "claude_code_grant",
     "claude_code_add_api_key",