docs: codify contribution flow — issues for features, PRs for review

Captures two carve-outs to aish's "non-PR-flow repo" default:

- Feature requests and bugs go to git.reauktion.de/marfrit/aish/issues
  rather than direct-implement-in-band. Tag `architecture` for cross-
  phase concerns. Aligns with the fleet-wide bug-filing convention from
  the `his` cheatsheet; this row extends it to features for aish.
- Review-required iteration opens a PR (authored as claude-<host>,
  marfrit reviews, self-approval forbidden). PR #1 was the precedent.

Both are opt-in; direct-to-main remains the default for autonomous
work that doesn't need a feedback loop.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -211,3 +211,27 @@ Token in the URL: `git push https://<user>:<token>@git.reauktion.de/marfrit/aish
 
 The user has marfrit-level credentials available via a separate channel
 if needed for repo-admin operations.
+
+---
+
+## 12. Contribution flow
+
+Default for direct work: **commit straight to `main`**. No PR, no issue
+gate. This is what "non-PR-flow repo" means in §11.
+
+Two opt-in carve-outs:
+
+- **Feature requests and bugs → Gitea issues** at
+  `git.reauktion.de/marfrit/aish/issues`. Don't implement feature
+  requests in-band; file the issue, let marfrit triage. Tag
+  `architecture` for cross-phase concerns. (Bug-filing convention is
+  fleet-wide per the `his` cheatsheet; this row extends it to features
+  for aish specifically.)
+- **Review-required iteration → PR**. When the medium needs to be the
+  diff (inline comments per finding, refinable wording), open a PR
+  authored as `claude-<host>` and let marfrit review. Self-approval
+  forbidden. PR #1 (`marfrit/aish#1`, 2026-05-10) set the precedent —
+  the MCP phase-2 question batch surfaced by review of `013c625`.
+
+When in doubt whether something is a feature request vs. an in-band fix,
+ask. Cheaper than the alternatives.