improvement(docs): lib-bootstrap pattern + development branch model + jsDelivr URLs

[Gumbees]

Summary

Three load-bearing doc changes plus the repo-shape flip that the docs describe:

• Lib bootstrap pattern. Leaf scripts that need shared helpers (oem-shared/lib/*, s3-api-lib/*) fetch them at runtime from jsDelivr pinned to a release tag and verify SHA256 before dot-sourcing. New commented-out block at the top of script-template-powershell.ps1, full recipe in CLAUDE.md under Common Patterns. Future-state note that CI may concatenate libs into fat scripts and turn the bootstrap into a no-op (Phase 2); until then, runtime fetch is the pattern.
• Branching model flip. development is now the default branch ... all bug/, refactor/, improvement/, feature/ PRs target it (squash merge). main is production ... only development -> main promotions and hotfixes land here, always via merge commit. Hotfixes off main get back-merged into development so the next promotion doesn't undo them. Matches the Change Taxonomy merge-method canon. CLAUDE.md Git Workflow section rewritten end-to-end.
• jsDelivr URL convention. Canonical script delivery URL is now https://cdn.jsdelivr.net/gh/dtc-inc/msp-script-library@<tag>/<path>. @release is the moving production tag (advanced on each promotion), @vX.Y.Z is the immutable pin. README gains a "Script Delivery (jsDelivr)" section explaining the tag conventions.

Repo operations also landed alongside this PR

The doc changes describe a model that already needed the repo to be reshaped. Done out-of-band before this PR opened so the PR body is accurate:

• Created development branch from origin/main (identical content, no drift at creation).
• Flipped GitHub default branch from main to development. New PRs target development by default.
• Re-targeted 15 currently-open PRs from main to development (PRs Dell7450 NVME Firmware Update #31, Enhancement/vixtemp cleanup #35, Add VixTemp folder cleanup script for dental imaging workstations #40, Add Storage Growth Monitor script for Ninja RMM (Ticket 1123004) #41, Add Schick 33/Elite USB sensor deployment automation script #42, Add weekly orphaned installer patch monitor for NinjaRMM #43, Add on-demand orphaned installer patch cleanup with safety quarantine #44, Add server lifecycle audit PowerShell script #47, Add Hyper-V host lifecycle audit script #48, Add NinjaRMM GUID to Halo PSA GUID Sync Script #49, Add Google Drive silent install + DC exclusion on SID detection #60, Add 180-day deletion for inactive administrator accounts #63, BitLocker enable + inventory rewrite with recovery key automation #64, Add SID change script + Dell server tools installer #66, improvement(docs): sync CLAUDE.md with DTC canonical change-taxonomy #67).
• Tagged release (signed annotated) on the tip of main so jsDelivr's @release resolves today. The tag is moving ... it will advance on each development -> main promotion.
• Added repo-level "Main Branch Protection" ruleset: PR required, 1 approving review, merge-commit-only (squash and rebase blocked on main). Mirrors dtc-inc/client-portal's release ruleset shape.
• development is already covered by the org-level "Default Branch Protection" ruleset via ~DEFAULT_BRANCH (PR required, 1 review). Status checks slot is ready for when CI lands.

Test plan

• PowerShell parser check on the modified template (passed locally with no errors)
• Manual review: lib-bootstrap example block parses cleanly when uncommented (verified locally)
• CLAUDE.md renders correctly on GitHub web view
• Spot-check one re-targeted PR (mergeable + correct base branch)
• Confirm jsDelivr URL serves expected content at @release once a real lib lands behind it
• After this PR merges into development, dry-run the development -> main promotion flow (merge commit, then advance release tag)

[claude]

⚠️ Code review skipped — your organization's overage spend limit has been reached.

Code review is billed via overage credits. To resume reviews, an organization admin can raise the monthly limit at claude.ai/admin-settings/claude-code.

Once credits are available, push a new commit or reopen this pull request to trigger a review.

[Gumbees]

Closing in favor of the OEM redo design captured at #74. The original approach (runtime lib bootstrap via jsDelivr, "baseline" naming with static policy files, hash placeholders) is being replaced with CI-generated fat scripts, internet check only at the install step, and RMM-env-var-driven configure scripts. New PRs will be opened against the foundation PR (separate, coming next).

Branch retained ... cherry-pick anything worth preserving from the new PR's branch.