Point the content conventions at the shared docs home

[CuWilliams]

Follow-up to GFPriceChecker#57, which was the last checkbox of GFPriceChecker#47 — moving repo-agnostic documentation to a shared home.

That PR turned the iOS repo's claude.md content conventions into a pointer at CuWilliams/shared-docs. This repo still held its own full copy of the same rules. Left alone, the duplication that work was meant to end simply continues in the other direction — two repos each holding a full copy of a rule that is legal exposure, free to drift apart.

What changed

Claude.md — ## Content Conventions gains a header naming gfpricechecker/CONTENT_CONVENTIONS.md as the source, and pointing at PRODUCT_DEFINITION.md for the data model, differential arithmetic and export formats.

README.md — the ## Writing conventions tax rule gains a paragraph saying where it is actually decided.

What deliberately stays

Not everything in that section is shared, and pushing the website-specific parts into a shared repo would be the opposite mistake:

• The tax-compliance rule is repeated, not merely linked. It is legal exposure. Nobody should have to open a second repo to discover it exists. The pointer says where it is decided; the short version stays here.
• The sweep command stays, because it is genuinely different — this one greps *.html and *.json where the app's greps *.swift. The data/blog.json standing exception is website-only too.
• Use the canonical host, Validate the data files, and Describe the app as it currently works are about this site's build and are not shared material.

Fixed along the way

• The documented sweep was broken under zsh. --include=*.html unquoted gets glob-expanded, and the command fails outright with no matches found rather than returning nothing — so a compliance check that looked like it ran had never run. Now quoted, with a comment saying why.
• Privacy caveat was incomplete. Backup files are unencrypted, which the file said; the stored tax ID is unencrypted too, which it did not. Both are now in shared CONTENT_CONVENTIONS.md §4 and PRODUCT_DEFINITION.md §5, amended and pushed before this PR.

Verification

• node scripts/validate-data.js — passes; no data/ files were touched.
• CRA sweep — only hits are terms.html:72 and terms.html:91. Both are disclaimers, not claims: the first states the app "does not provide tax, legal, or medical advice"; the second sits inside a "We do not guarantee that:" list, so it explicitly disclaims CRA suitability. Correct as written.
• Canonical-host sweep — no bare-apex absolute URLs.
• The v1.2.0 reference added to Claude.md matches CHANGELOG.md:65, which records removing exactly this class of claim on 2026-08-12.

No site content changed — documentation only.

🤖 Generated with Claude Code