docs: harden project harness template

[PerfectPan]

Summary

• Add a cross-project harness contract for delivery evidence, validation gates, and repository hygiene.
• Expand PR/MR and issue templates so review starts with motivation, implementation notes, exact validation, evidence, safety checks, and risks.
• Add an active GitHub Actions harness workflow that runs the generic repository-hygiene check on pushes to main and pull requests.

Motivation

This template is meant to be copied into many projects. The harness layer should make the expected review and delivery evidence explicit before each project chooses a stack. The stack-neutral hygiene gate can run immediately, while format/lint/test/build remain project-specific placeholders.

Implementation Notes

• scripts/harness-check.sh checks required template files, PR/MR section drift, tracked local/generated artifacts, obvious credentials, private paths, and placeholder private references.
• .github/pull_request_template.md and .gitlab/merge_request_templates/default.md now share the same required review sections.
• .github/workflows/harness.yml directly enables the generic hygiene gate. Stack-specific CI remains in .github/workflows/ci.yml.example until a project chooses its language/framework.

Validation

• Repository hygiene: ./scripts/harness-check.sh
• Script syntax: bash -n scripts/harness-check.sh
• Whitespace check: git diff --check
• Format: skipped, no project formatter is configured in this stack-neutral template.
• Lint: skipped, no project linter is configured in this stack-neutral template.
• Test: skipped, no test runner is configured in this stack-neutral template.
• Build: skipped, no build command is configured in this stack-neutral template.
• Package or release dry-run: skipped, no package command is configured in this stack-neutral template.

Evidence

• Remote branch head verified: origin/feat/harness-template points to 445a0b762833789c058edb014e51ae507af57d85.
• Commit signature verified locally with git log -1 --show-signature.

Safety Checklist

• No credentials, tokens, private hostnames, personal filesystem paths, or generated logs are included.
• Local config, generated output, build artifacts, and temporary workspaces are not staged.
• User-facing template docs and changelog are updated.
• The branch is pushed and the remote head matches the intended commit.

Follow-up Risks

• Projects still need to replace stack-specific command placeholders after choosing their language/framework.