docs: winrm re-enabled for deployment activities only (2026-09-28)

Replaces the 2026-09-11 remote-exec hold: WinRM exec is allowed only for the on-box steps of a
user-requested deploy; ad-hoc diagnostics/version checks use SMB, HTTP or SQL. SMB file copies and
direct SQL logins remain always allowed. Scope rules live in the winrm skill's Scope section.

CLAUDE.md

@@ -190,11 +190,12 @@ publish; registry `BaseUrl` host rule) and the QA topology note: [`ZB.MOM.WW.Ove
 > is orthogonal to the deployment tier. No production box has been identified. Full host/port
 > inventory for both tiers: [`deployment.md`](deployment.md) §2.1 + §7.1.
 >
-> ⛔ **Remote command execution on the wonder boxes is DISABLED (2026-09-11).** The `winrm` skill
-> (WinRM exec/ps, service control) set off the security software and has been moved to
-> `~/.claude/skills-disabled/winrm`; do not use it or stand up a replacement channel until the user
-> clears one. **Still allowed:** UNC/SMB file copies to the boxes and logging directly into the SQL
-> Servers. Any deploy step that needs a command run on a box is blocked until a new channel is found.
+> ⛔ **Remote command execution on the wonder boxes: DEPLOYMENT ACTIVITIES ONLY (2026-09-28).** The
+> `winrm` skill was disabled 2026-09-11 (WinRM exec/ps set off the security software) and re-enabled
+> 2026-09-28 scoped to deploys: remote exec only for the on-box steps of a deploy the user asked for
+> (preflight, backup, stop/swap/start, migration, post-deploy verify, rollback). No ad-hoc diagnostics,
+> log grepping or version checks over WinRM — use SMB, HTTP or SQL. **Always allowed:** UNC/SMB file
+> copies and logging directly into the SQL Servers. Scope rules live in the skill's *Scope* section.
 >
 > **Deployed state (2026-09-10):** DEV and both QA nodes run every repo tip — ScadaBridge `2b9a7c3c`,
 > OtOpcUa `b8b4c18f`, mxaccessgw `4f931e4` (Server + x86 Worker), HistorianGateway `d8d890c`, Overview