docs(claude): add State Hub tunnel setup instructions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -142,6 +142,36 @@ make ingest-sbom REPO=railiance-cluster SCAN=1 REPO_PATH=/home/worsch/railiance-
 
 ---
 
+### Remote Execution & State Hub Tunnel
+
+This repo is designed to be worked on **from the HostEurope server**. The
+State Hub runs on Bernd's local workstation at `127.0.0.1:8000` and is not
+publicly reachable — a reverse SSH tunnel must be open before starting a
+remote session.
+
+**On your local machine, before SSHing to the server:**
+
+```bash
+cd ~/railiance-infra
+make tunnel   # opens: ssh -R 8000:127.0.0.1:8000 tegwick@92.205.62.239
+```
+
+Keep that terminal open. Then SSH in normally from a second terminal.
+
+**Verify the tunnel is live from the remote:**
+
+```bash
+curl http://127.0.0.1:8000/state/health
+# expected: {"status":"ok"}
+```
+
+**If the tunnel is not up (degraded mode):**
+- The `get_domain_summary` call in Step 1 will fail
+- Skip Step 1 — proceed from local workplans only (Step 2)
+- Log any progress events manually from the local machine after the session
+
+---
+
 ### Quick Reference
 
 `~/the-custodian/state-hub/mcp_server/TOOLS.md` — compact MCP tool reference