feat(claude-code): update placemat for Claude Code v2.1.289

[dommango]

Summary

• npm dist-tags.latest for @anthropic-ai/claude-code is 2.1.289, confirmed against the official changelog (v2.1.289, dated 2026-10-03), one version ahead of the placemat's previous v2.1.288.
• Reviewed every v2.1.289 entry against the placemat's eight cards (slash commands, settings keys, hook events, keybindings, env vars, CLI flags). This release is scoped entirely to the mods/plugin rendering engine, Bash deny/ask-rule edge cases under sandbox auto-allow, and a VSCode claude auth status revert — all bug fixes to existing internal behavior, with no new or changed slash command, settings key, hook event, keybinding, CLI flag, or env var. The one Added item (agent.spawn / $.agent.list() states for mods) is a plugin JS SDK method, the same category as v2.1.288's $.ui.selection(), which the placemat doesn't track (no Mods-SDK card/group exists).
• Per AGENTS.md's per-page parity rule ("releases with nothing placemat-relevant get no entry" / release tag may run up to 3 versions ahead of the newest changelog entry), this PR bumps only the header .release-tag and .print-head to v2.1.289 to record that it's been checked. No changelog entry, no changes.json/feed.xml regen (confirmed no diff from build-changes.js), and no sources.json inventory re-extraction, since no rows were added.

Checklist

• Version polled from registry.npmjs.org and cross-checked against code.claude.com/docs/en/changelog
• Every v2.1.289 entry reviewed against the Keys/Slash/CLI/Settings/Env/Skills/Hooks cards — nothing placemat-relevant found
• node scripts/build-changes.js claude-code run — no diff to changes.json/feed.xml
• node tests/placemat.test.js claude-code — 54 passed, 0 failed
• No open sync blocked: claude-code issue existed, so none needed closing
• Did not touch any other agent's directory

🤖 Generated with Claude Code

https://claude.ai/code/session_01MvcJoMGCzvBV6tw4dkX7wt

---

Generated by Claude Code

[dommango]

Merge-gate code review (Step 10)

Verdict: clean — no CRITICAL/HIGH finding on this PR's diff.

Scope: git diff main...HEAD -- claude-code/index.html is exactly 2 lines — .release-tag and .print-head bumped v2.1.288 → v2.1.289.

Checked against AGENTS.md's per-page parity rules:

• Header tag and print-head agree with each other (both v2.1.289) — pass
• Newest changelog release is still v2.1.288 (2026-10-02), and the footer "Content synced 2026-10-02" still matches it — pass
• Release tag is only 1 version ahead of the newest changelog entry, well inside the "at most 3 versions ahead" allowance for a release with nothing placemat-relevant — pass
• node tests/placemat.test.js claude-code — 54/54 passed
• node scripts/build-changes.js claude-code — no diff to changes.json/feed.xml
• Commit message matches the feat(<agent>): update placemat for <Name> v<newest> convention

One finding surfaced, out of scope for this PR, not blocking: index.html has 11 rows (e.g. line 242, /output-style [name]) still carrying hard-coded class="new" and <!-- added:vX.Y.Z --> markers from pre-v1.2-template releases, which AGENTS.md explicitly retired ("never write class=\"new\" into any index.html"; shared/placemat.js is supposed to compute "new" per-visitor from changes.json at runtime). This is identical on main — not introduced by this diff, which touches only the header. It's a low-severity cosmetic issue (those rows render as permanently "new" only if a visitor's changes.json fetch fails, e.g. file:// viewing or JS disabled) rather than a CRITICAL/HIGH defect, so it doesn't block this merge gate, but it's worth a follow-up cleanup pass across the retired markers.

Proceeding to merge per Step 10 (no CRITICAL/HIGH finding, CI green).

---

Generated by Claude Code