Scope supply chain rules to MCP CLAUDE files

Author: rodion-m

.github/workflows/CLAUDE.md

@@ -0,0 +1,5 @@
+# MCP CI Workflow Rules
+
+- Pin every external action to a full commit SHA and keep the release tag in a comment.
+- Do not use floating Python or Docker setup actions in CI/release workflows.
+- When updating dependency-related workflow steps, prefer reproducible installs over convenience aliases.

CLAUDE.md

@@ -17,6 +17,12 @@ source .venv/bin/activate  # On Windows: .venv\Scripts\activate
 pip install -e .
 ```
 
+## Dependency Rules
+
+- Keep Python dependency specifiers exact where this repository already pins them, including test extras and `build-system`.
+- If `pyproject.toml` changes affect resolved packages, verify the result through the lock/install path used by CI.
+- Do not introduce floating versions in CI or release automation when exact pins are practical.
+
 ### Running the MCP Server
 ```bash
 # Basic run with stdio transport
@@ -155,4 +161,4 @@ The project uses automated publishing:
 - **Minor** (0.2.0 → 0.3.0): New features, enhancements
 - **Major** (0.2.0 → 1.0.0): Breaking changes, major releases
 
-When implementing features or fixes, evaluate if they warrant a version bump for users to benefit from the changes through the MCP Registry.
+When implementing features or fixes, evaluate if they warrant a version bump for users to benefit from the changes through the MCP Registry.