Update CLAUDE.md: certifi dep, Node 24 workflow, branching convention

CLAUDE.md

@@ -2,11 +2,16 @@
 
 This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
 
+## Branching convention
+
+- **Code changes** (`mdcms.py`, `pyproject.toml`, `app/`, `.github/`) — use branch `mdcms_cli` (create from `main` if it doesn't exist), PR to `main`.
+- **Documentation only** (`CLAUDE.md`, `docs/`) — push directly to `main`.
+
 ## What this project is
 
 MD-CMS is a markdown-based static site system with two distinct parts:
 
-1. **`mdcms.py`** — a Python 3 CLI tool (`click` + `PyYAML`). Manages a registry of sites, scans content, generates `nav.yml` and `search.json`, and is designed for both local use and GitHub Actions pipelines.
+1. **`mdcms.py`** — a Python 3 CLI tool (`click` + `PyYAML` + `certifi`). Manages a registry of sites, scans content, generates `nav.yml` and `search.json`, and is designed for both local use and GitHub Actions pipelines.
 2. **`app/index.html`** — a single-file browser renderer that reads markdown, config, and nav at runtime entirely client-side. There is no build pipeline, no compilation, no server.
 
 The `app/` folder is the deployable artifact and the starter template downloaded when registering a new site. `mdcms.py` lives outside it.
@@ -29,6 +34,8 @@ docs/
   documentation.md
   knownlimitations.md
   quickstart.md
+  install.md
+  release.md
 .github/workflows/release.yml   ← cross-platform release builds
 samplesite/                     ← reference implementation (not deployed)
 ```
@@ -63,7 +70,7 @@ Single-module Python script. Logical layers in order:
 6. **Scanner** (`scan_and_categorize`) — walks a directory, skips drafts, returns records with the first 5000 chars of body for search indexing. Paths are relative to `site_root`.
 7. **Nav/search generators** — `generate_nav_yml()` emits a fixed-format YAML subset. `generate_search_json()` emits a JSON array. `merge_sections()` preserves existing section metadata on rebuild.
 8. **Core build** (`run_build`) — orchestrates the full build: version check → config read → scan → merge → write nav.yml and search.json.
-9. **Template download** (`download_template`) — fetches `app/` from GitHub via the Contents API using `urllib` (no extra dependencies). Recursively downloads files and directories.
+9. **Template download** (`download_template`) — fetches `app/` from GitHub via the Contents API using `urllib` + `certifi` for SSL. Recursively downloads files and directories.
 10. **CLI commands** (`register`, `delete`, `view`, `build`) — implemented with `click`. Entry point: `main()` → `cli()`.
 
 ## Version markers
@@ -160,7 +167,7 @@ Reliable tags (others are known-broken): `posts-datetime-chronological-byyearmon
 | `macos-latest` | `mdcms-macos-arm64` binary |
 | `windows-latest` | `mdcms-windows-amd64.exe` |
 
-All artifacts are attached to the GitHub release using `gh release create`.
+All artifacts are attached to the GitHub release using `gh release create`. The workflow sets `FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true` to opt into the Node.js 24 runner ahead of the June 2026 forced migration.
 
 **Release checklist** — before tagging:
 1. Update `CLI_VERSION` in `mdcms.py`
@@ -181,4 +188,4 @@ Then: `git tag v0.3.1 && git push origin v0.3.1`
 - Category code validation uses `CATEGORY_CODE_RE = re.compile(r"^[a-zA-Z0-9\-]+$")` — codes must match this.
 - `scan_and_categorize()` takes both `directory` and `site_root` — paths in records are always relative to `site_root`.
 - The `samplesite/` directory is a reference implementation with multi-language categories (English, Norwegian, Arabic including RTL). It is not deployed; it exists for reference and testing.
-- Template download uses `urllib` (stdlib) only — no `requests` dependency.
+- Template download uses `urllib` (stdlib) with `certifi` for SSL certificate verification — required for PyInstaller binaries on Linux/macOS where the bundled Python cannot find system CA certificates.