docs: record surgical-deploys docker-dev live gate (PASSED) + correct rename-vs-identity rebuild wording

CLAUDE.md

@@ -140,7 +140,10 @@ is still default-closed; what changed is which deltas it whitelists.
 
 - **Still a full rebuild:** an **alarm-bearing** raw-tag delta (`Alarm != null` on either
   side — the WP4 guard: only a rebuild clears and re-wires native-alarm notifiers), an
-  **identity** change on a raw tag (`TagId`/`DriverInstanceId`/`Name`/`ParentNodeId`/`Realm`),
+  **identity** change on a *paired* raw-tag delta (`TagId`/`DriverInstanceId`/`ParentNodeId`/`Realm`
+  — pairing is by RawPath, so this guard catches a tag deleted and re-created under the same path;
+  a plain **rename never pairs** and is served surgically as remove-one-node + add-one-node with any
+  referencing UNS mirror re-pointed, live-gated 2026-08-15),
   a raw **container** (Folder/Driver/Device/TagGroup) rename or removal, `ChangedEquipment` /
   `ChangedAlarms`, a non-surgical equipment-tag delta, and anything else the
   `with`-equality whitelist does not name (including any FUTURE field).