chore(create-openora): let consumer sessions make any core change in an OSS worktree

[zaxovaiko]

Summary

The consumer template now lets a consumer session make any core change, new features included, in an OSS worktree. It also configures Claude Code so that --add-dir loads the OSS repo's CLAUDE.md and rules. BF-0.

Why

The oss-boundaries rule, cross-repo.md, and the review and handoff skills sent every new core feature to a separate session rooted in the OSS repo. A paired change (a core feature plus the consumer's adaptation) therefore always took two agent sessions and a handoff prompt. The guard-core hook already limits core edits to .worktrees/, so the extra session added friction but no safety. The genericity test, the verify step, and the OSS review step before any push are unchanged.

The Claude settings template also changes:

• It sets CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1. Without it, --add-dir loads the OSS repo's skills and agents but not its CLAUDE.md or .claude/rules/. additionalDirectories on its own grants file access only.
• It drops the Write(./node_modules/**) deny rule. Claude Code ignores Write(...) path rules and warns about them at startup; Edit(./node_modules/**) already covers every file-editing tool.

Alternatives considered

• Keep the separate-session rule and rely on handoff. Rejected: the handoff prompt carries context the consumer session already has, and it doubles the sessions for every paired feature.
• A per-developer local override. Rejected: it leaves two contradictory rules in context.

Risks

• Larger core changes can now start from a consumer session. The genericity test and the OSS verify and review steps still apply before any push, and the review skill still checks the paired OSS diff against the OSS repo's own rules.
• Existing consumers pick this up on their next @openora/* bump. Their hand-kept .claude/settings.json does not change until they apply the env entry themselves.