Add /mode command — auto-detecting work mode with terminal color

Five modes: client (orange), dev (cyan), infra (red), general (blue),
remediation (purple). Auto-detects from user messages using keyword
priority rules. Manual override via /mode <name>. Color changes via
/color on mode transitions. Posture adjusts per mode (e.g., infra =
confirm-before-destructive, dev = delegate freely).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/CLAUDE.md

@@ -54,6 +54,29 @@ Commits use the local git config (user.name / user.email), which is set per-user
 
 Both users have identical access. No permission gating between them. If a new team member is added later, their role and access scope should be defined in `.claude/users.json` before they sync.
 
+## Work Mode (auto-detect + color)
+
+Claude operates in one of five modes. Mode determines terminal color and operational posture. **Auto-detect on every user message** using these priority rules (first match wins):
+
+1. **remediation** (purple) — "remediation tool", "365", "breach", "tenant sweep", M365 keywords
+2. **client** (orange) — client name mentioned (check `clients/` dirs), work under `clients/`, "for \<client\>"
+3. **infra** (red) — server names/IPs (AD2, Jupiter, 172.16.x.x), SSH, firewall, DNS, deploy, service restart
+4. **dev** (cyan) — code, build, compile, Rust/cargo, npm, GuruRMM dev, testing, work under `projects/`
+5. **general** (blue) — default
+
+**On mode change:** update `identity.json` "mode" field, change terminal color, announce briefly: `[MODE -> infra]`. Don't interrupt workflow.
+
+**Manual override:** user can run `/mode <name>` to force a mode. `/mode auto` re-runs detection. `/mode` shows current.
+
+**Posture by mode:**
+- **client (orange):** careful with data, session logs go to `clients/`, always name the client
+- **dev (cyan):** delegate freely to Coding/Testing agents, less confirmation friction
+- **infra (red):** confirm before destructive ops, backup-first, double-check IPs
+- **general (blue):** lightweight, default
+- **remediation (purple):** Graph API focus, compliance language, full audit trail
+
+Full details: `.claude/commands/mode.md`
+
 ---
 
 ## Identity: You Are a Coordinator