[davidwkeith]

Summary

Adds a Key constraints bullet to packages/server/CLAUDE.md, the @dwk/server counterpart of the root note from #559. Tests pass throwaway secrets inline (secrets: { TOKEN_SIGNING_KEY, … } in the phase* integration tests), and env.test.ts runs loadDwkEnv({ cwd }) against temp dirs, so no secret file is needed locally or in CI.

It also records one leak: cli.test.ts calls main(), which calls loadDwkEnv() with no cwd. That reads .env/<domain>.env from the working directory, so a local .env there ends up in process.env while that file runs.

Packages affected

@dwk/server (docs only)

Checklist

• Read the relevant spec(s) under spec/packages/ and updated them if
  behaviour changed — not applicable, no behaviour change
• Added/updated colocated tests (src/*.test.ts) — not applicable, docs only
• Ran the local CI gate: pnpm lint && pnpm format:check && pnpm typecheck && pnpm build && pnpm test — only prettier --check on the changed file; no code changed
• Added a changeset (pnpm changeset) if this touches a publishable
  package — not applicable, @dwk/server is private
• Updated catalog.json / conformance/status.json if this adds a new
  mountable worker or changes conformance status — not applicable, no new worker

---

Generated by Claude Code