feat(features): gate Claude Code on the host CPU microarchitecture level

Claude Code runs on Node, whose V8 build requires SSE4.2 and POPCNT
(x86-64-v2). On an older x86_64 CPU it does not run, so it must not be
installed there in the first place.

Nix cannot detect the CPU (pure evaluation, hosts often built elsewhere),
so add features.cpu.microarchLevel: the psABI level a host declares about
itself, defaulting to 2. features.claudeCode.enable derives from it, and
home/claude.nix reads that through home-manager's osConfig and installs
nothing -- CLI, CLAUDE.md, output style or memory symlink -- when it is
off. Hosts without the option (Darwin, the standalone homeConfigurations)
keep the tool enabled.

An assertion fails evaluation if a host force-enables the flag below the
required level, so the mistake surfaces in nix flake check rather than as
an illegal-instruction crash on the machine.

home/README.md

@@ -175,8 +175,16 @@ forced off there) but still runs the agent.
 
 ## Claude Code
 
-Managed declaratively by [`claude.nix`](./claude.nix) on every host (the CLI is
-`pkgs.claude-code`, tracked to unstable via the flake overlay).
+Managed declaratively by [`claude.nix`](./claude.nix) on every host whose CPU
+can run it (the CLI is `pkgs.claude-code`, tracked to unstable via the flake
+overlay).
+
+**Capability gate.** The module installs nothing — CLI or files — when
+`osConfig.features.claudeCode.enable` is off. That flag is derived fleet-wide
+from the host's declared CPU level (see "CPU capability gating" in the root
+README): the Node runtime needs SSE4.2/POPCNT, so anything below x86-64-v2 (the
+Mac Pro 3,1) is excluded. Hosts that do not define the option — the Darwin host
+and the standalone `homeConfigurations` — keep it enabled.
 
 | Managed (static, from Nix)                          | Left mutable (runtime state)                           |
 | --------------------------------------------------- | ------------------------------------------------------ |