Update CLAUDE.md: mark scan-to-download TODOs done, add commit/push convention

Standing convention: commit and push once a task is verified working,
without waiting for a separate go-ahead each time -- see the new bullet
under Conventions specific to this repo.

CLAUDE.md

@@ -8,12 +8,10 @@ photos/calendar/whiteboard widget system to the device.
 
 CURRENT TODO
 Fix spurious button assignment stuff (probably but buttons on widget config with sane defaults)
-FIX Scan to download
 make a weather widget
 widget border option
 battery life widget
 sharing layouts with linked users
-when multiple photo widgets on layout, the "scan to download" should create a share with all the photos on 
 a "coming up this week" widget
 
 Start here, don't re-derive from scratch:
@@ -50,6 +48,16 @@ Start here, don't re-derive from scratch:
   tempted to exclude and why. This repo shipped a token gate once that
   covered `/api/*` but left `/frame/image` -- the actual photo bytes --
   open; caught immediately in production.
+- **Commit and push once a task is verified working, without waiting to
+  be asked separately.** Once tests pass (and, for UI changes, the
+  browser check has been done), stage the relevant files, write a normal
+  commit message, and push to the current branch -- the maintainer's
+  standing authorization for the commit/push step itself. This doesn't
+  relax anything else: still run `git status`/review the diff before
+  staging, still never force-push/amend a pushed commit/skip hooks, and
+  still surface anything that looks like it needs a real decision (e.g.
+  a change that would trigger `main`'s deploy workflow, see below)
+  instead of pushing through it silently.
 
 ## Working in this repo