docs: add critical git workflow rule - never push to production without explicit instruction

CLAUDE.md

@@ -266,6 +266,12 @@ Towerops uses branch-based deployment with Forgejo CI/CD:
 
 ### Deploying Changes
 
+**CRITICAL GIT WORKFLOW RULE:**
+- **ALWAYS** push to `main` after commits (default behavior)
+- **NEVER** push to `production` unless explicitly instructed by the user
+- Production deployments must be manually authorized each time
+- When in doubt, only push to `main`
+
 **To staging:**
 ```bash
 git push origin main
@@ -273,7 +279,7 @@ git push origin main
 # Watch: https://git.mcintire.me/graham/towerops-web/actions
 ```
 
-**To production:**
+**To production (ONLY when explicitly requested):**
 ```bash
 # Merge main → production
 git checkout production